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FOREWORD 


Final documentation of the Safety in Earth Orbit Study is submitted by 
the Space Division of North American Rockwell Corporation to the National 
Aeronautics and Space Administration, Manned Spacecraft Center, Houston, Texas, 
in compliance with DRL Line Items 3 and 4 of NASA-MSC Contract NAS9-12004. 

The study was performed for the NASA Manned Spacecraft Center by the Space 
Applications Program organization at the Space Division (SD) of North American 
Rockwell (NR). Mr. P. E, Westerfield of the Safety Office was the NASA 
Technical Manager. 

Documentation of the study results is as shown in the following table. 
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1.0 INTRODUCTION 


Most of the manned spaceflight programs planned by NASA for the late 
1970's and 1980's are concentrated on earth orbital operations- These will 
use the shuttle and a variety of manned and unmanned payloads delivered to 
orbit by the shuttle. 

This 12-month study examined five specific safety issues associated 
with these operations. The study logic used is shown in Figure 1-1. The five 
issues were studied as five separate tasks in the order shown. Hazards 
analyses were used on the first three tasks only. 
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1.1 SCOPE 

The study scope covered the vehicles shown in Figure 1-2. 



SHUTTLE ORB I TER 


SHUTTLE PAYLOADS SPACE STATION 


•INTEGRAL TANK 
• DROP TANK 


• SORTIE MODULES • INITIAL (6-MAN) 

• SATELLITES • GROWTH (’2-MAN) 

• UPPER STAGE VEHICLES 


Figure 1-2. Vehicles Considered in Study 

Initial tasks were based on the integral tank shuttle orbiter, but emphasis 
was later switched to the drop tank orbiter as this concept developed. The 
assumptions made were broad enough that no results were invalidated by this 
change. 

Shuttle payloads considered included manned and unmanned sortie payloads 
(i.e., attached to the orbiter), satellites delivered to earth orbit, and 
potential upper stage vehicles, such as the tug, Agena, Centaur, etc., used to 
deliver unmanned payloads to orbits beyond the orbiter's capabilities. 

The space stations considered were modular stations delivered to earth 
orbit and assembled by the orbiter. Initial 6-man versions and growth versions 
with up to 12 men, as defined recent Phase B studies, were studied. 
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To the maximum extent possible, the analyses were performed with the min- 
imum configuration oriented and operational assumptions possible, in order to 
have the results applicable over as wide a range of changes from currently 
planned programs as possible. 

Within the scope of the vehicles described, the study is bounded by the 
following study ground rules: 

• The main concern is personnel safety, A lesser emphasis was 
placed on avoiding damage to or loss of the vehicles. 

• The analysis was confined to the manned on-orbit phase of 
missions. Launch, boost, deorbit, reentry and landing of 
the orbiter, or unmanned operations of the station and 
upper stage vehicles away from the orbiter were not con- 
sidered. 

• The study results cover only the specific concerns of the 
study. They must not be assumed to cover all safety 
aspects of the relevant vehicles. 

1.2 STUDY OBJECTIVES 

The study concerned itself with five specific issues. These issues and 
their objectives are: 

1. Hazardous payloads . The objective was to identify hazards 
associated with certain orbiter payloads and to determine 
safety requirements and guidelines. 

2. Docking . The objective was to compare a number of different 
approaches for docking an orbiter to a space station, and to 
recommend the methods preferred from a safety point of view. 

3. On-board survivability . The objective was to determine the 
configurational and other requirements for the orbiter, 
sortie module and space station to allow personnel to survive 
on-board emergencies. 

4. Tumbling spacecraft . The purpose was to determine practical 
means for arresting the motion of out-of-control tumbling 
spacecraft by external means, or to allow on-board personnel 
to escape from a spacecraft if tumbling cannot be arrested. 

5* Escape and rescue . The objective was to determine the applic- 
ability of previcus or new concepts for escape, rescue, and 
bail-out survivability to the orbiter, sortie modules and space 
station. 

This volume presents a summary of the technical results and conclusions 
of the study. It is arranged by task, Sections 2 to 6 each covering one of the 
tasks, in the order in which they were performed, as shown in Figure 1-1. The 
complete analyses are documented in Vol. II of this report for the first three 
tasks and in Vol. Ill for the last two tasks. 
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1.3 RELATIONSHIP TO OTHER STUDIES 

The Safety in Earth Orbit Study was perfor.... . in the context of a wide 
range of related studies. This relationship is shown in Figure 1-3. 

The most important of these studies are the Phase B studies on the space 
station, shuttle and RAM (Research and Applications Modules) . These studies 
were the main * ources of data on the station, shuttle and sortie module, 
respectively. Phase A studies on the Tug, Orbit-to-Orbit Shuttle (00S) and the 
Chemical Interovbital Shuttle, and concurrent systems studies on the Orbital 
Operations and tho In-Space Propellant Logistics (ISPLS) Studies provided addi- 
tional info.mption , both on relevant hardware elements and on operational modes. 

A good intarcuange of information was possible with all these studies for 
which NR was a prime contractor (subcontractor on the RAM). The interchange of 
information and ideas generally flowed in both directions. This interchange was 
particularly fruitful with the Orbital Operations Study and the safety portion 
(Phase 2) of the ISPLS study. 

Additional safety background vas obtained from earlier safety studies by 
Boeing (on the space station), Lockheed (on the shuttle), and from ongoing 
studies by the Aerospace Corporation (on the shuttle and on escape and rescue) . 

A particularly useful cooperative effort was also established with the Pennsyl- 
vania State University on the dynamics of tumbling spacecraft. 
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Figure 1-3. Relationship to Other Studies 
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1.4 BASELINE MDDEL 

The baseline model discussed in this section describes typical shuttle 
orbiter configurations, shuttle missions, and the interfaces with the shuttle 
payloads, sortie modules, and the space station. 

While this model is typical, many variations have been or are being con- 
sidered. The attempt has been made to make the results of the entire study as 
insensitive to the concepts, configurations, operational modes, design details, 
and program schedules as possible, so as not to invalidate the study as the 
space program evolves. This has been done by dealing with the problems para- 
metrically, and not typing the analyses to specific designs, sizes, or missions. 
The description of the baseline model that follows, therefore, should be read 
as describing typical current concepts, and not the concepts assumed for the 
s tudy . 

1.4.1 Typical Shuttle Mission 

A typical shuttle mission, shown in Figure 1-4, was generated from NR 
Phase B shuttle data to identify approximate projections of shuttle functions 
and timelines, and to illustrate the scope of this study within the shuttle 
mission. Earth orbit is interpreted for purposes of the study as encompassing 
that portion of the mission that starts with orbit injection and terminates with 
deorbit. On-orbit time can be up to 30 days. 


SAFETY IN EARTH ORBIT 



Figure 1-4. Typical Shuttle Mission 

5 




SD 72-SA-0094-1 







Space Division 

North American Rockwell 


At launch (t Q ) the orbiter and booster are mated and remain mated until 
staging, at which time separation occurs and the booster flies back to a landing 
site, while the orbiter initiates a main engine bum to effect injection into a 
93 by 185 km (50 by 100 n mi) orbit at approximately t 0 + 9 minutes* Immediately 
after post-insertion checks on orbiter subsystems, the orbiter cargo bay doors 
are opened to expose the orbiter space radiators on the inside of the cargo bay 
doors to space* This occurs at approximately 9 to 40 minutes after launch. At 
approximately 50 minutes, the apogee of the 93 by 185 km (50 x 100 n mi) orbit 
is obtained and a circularization bum is performed to circularize the orbiter 
in the 185 km (100 n mi) phasing orbit. After initial phasing relative to the 
target vehicle is accomplished, rendezvous and phasing adjustments are made -dur- 
ing a series of Hohmann transfer bums to a circular orbit approximately 18.5 km 
(10 n mi) below the target vehicle. Final phase adjustments are made prior to 
initiating the terminal phase initiation burn to complete the rendezvous, station- 
keeping, and docking operations. 

During the subsequent on-orbit stay time at the target vehicle orbit, the 
orbiter can either be attached to or can station-keep at a sate distance from 
the target vehicle* 

Shortly before deorbit, phasing with a landing site is accomplished, 
system checks are made, and the cargo bay doors are closed. The deorbit bum 
which follows will result in entry to the earth’s atmosphere at approximately 
122 km (400,000 feet) and subsequent approach and landing at the preselected 
landing site. 

It is significant to note that the orbiter cargo bay doors would be closed 
for only 1/2 hour to 1 hour while on orbit for a shuttle mission of any dura- 
tion. 


1.4,2 Typical Orbiter Model 

The primary orbiter concepts considered in the study are shown in Figures 
1-5 and 1-6. The integral tank orbiter concept resulting from NR Phase B 
shuttle studies is shown in Figure 1-6 and includes such features as a 4.6 m 
15-f t-diameter by 18.3 m 60-ft-length cargo bay with hinged cargo bay doors, 
two manipulators with peripheral illumination, visual and operating aids, a 
manipulator operator station, and an airlock docking port which interfaces with 
the crew and passenger compartments and with a personnel transfer port leading 
to the cargo bay. This configuration includes integral LH 2 and LO 2 propellant 
tanks for the main propulsion system used for orbit injection, and the auxiliary 
propulsion system used for orbit maneuvering and attitude control. An air- 
breathing propulsion system, which employs JP fuel and turbofan engines, is 
incorporated to provide the capability for short-duration powered descent after 
vehicle entry, powered landing and go-around, and vehicle ferry operations. 

The drop tank orbiter configuraticn resulting from NR Phase B extension 
studies is shown in Figure 1-6 and differs from the previous configuration 
primarily in that it features an external jettisonable LO 2 /LH 2 ascent propellant 
tank, employs storable hypergolic propellants (nitrogen tetroxide and Aerozine 
50) for the orbit maneuvering and attitude control systems. It is a lighter 
vehicle than the Integral tank orbiter with a geometry which required relocation 
of the airlock dockl/tg port to the nose of the vehicle. 
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Figure 1-5. Integral Tank Orbiter Concept 
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The initial MDAC orbiter concept, which is similar to the NR integral 
tank orbiter, also employs integral LO 2 and LH 2 propellant tanks. However, a 
rotation payload deployment mechanism concept is used in lieu of an articulating 
manipulator, as shown in Figure 1-7, 



1,4.3 Typical Orbiter Payloads 

Orbiter payloads considered in the study include the following: 

1. Unmanned pallet-type sortie payloads, which remain attached 
to the orbiter. These may remain in the cargo bay, or be 
deployed out of it for exposure to space. 

2. Manned sortie modules, which remain attached to the orbiter. 
These also may remain in the cargo bay, or be deployed out of 
it during orbital operations. These may be flown combined 
with an unmanned pallet payload. 

3. Automated payloads. These include satellites and subsatellites 
delivered to orbit by the orbiter and operate detached from the 
orbiter. These also can be retrieved for servicing or return 
to earth. 

4. Upper stage vehicles with their payloads. These are used as a 
shuttle third stage to deliver payloads beyond the orbiter’s 
capability. The upper stage vehicles considered as candidates 
include: 

o Agena 
o Centaur 
o Burner II 
0 Transtage 

o Apollo service module (SM) 
o T,, g or orbit-to-orb i t shuttle (00S) 
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The Centaur, tug, and OOS, and possibly the Si., are considered reusable 
and may be retrieved. The others are expendable. These include the modules 
required for buildup of the permanent station, cargo modules for logistics 
resupply, experiment modules, and replacement modules as required. All these 
modules are returnable to earth in the orbiter. 

1.4. A Typical Space Station Model 

The primary modular space station (MSS) concepts being considered by NR 
and MDAC for the initial station are shown in figures 1-8 and 1-9. As shown 
in Figure 1-8, the NR initial station consists of nine modules requiring a 
like number of shuttle flights for the station buildup. Similar data for the 
MDAC initial modular station are presented in Figure 1-9. 
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Launch No. 

Module 

Module Elements 

i 

Core 

Power generation and conversion, IVA/EVA air- 
lock, guidance and control, reaction control, 
consumables 

- 

Power 

Solar array, emergency hatch, Gk’2, GO2 

3 

Control/Crew 

Control center, personal hygiene, data analysis, 
commander/exec stateroom isotonic exercise area, 
photo lab, crew stateroom, waste management 
equipment 

4 

ECS/ Labs 

' 

Environmental control and life support equip- 
ment, nadir airlock, mechanical lab, optical/ 
electrical lab, bioscience/earth observation 
laboratory 

5 

ECS/ Labs 

Environmental control and life support equip- 
ment, zenith airlock, galley, dining and 
recreation, physics/biomedical lab 

6 

Control/Crew 

Control center, personal hygiene, medical and 
crew care, commander/ executive stateroom, crew 
stateroom 

7 

Crew/Cargo 

Crew, propellants, consumables 

8 

RAM 

Experiments 

9 

RAM 

Experiments 


Figure 1-8. NR Modular Space Station 
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Launch No. 

Module 

i 

Power/ Subsystems 


Crew/Operations Module 

3 

General Purpose 
Laboratory 

4 

Logistics Module 


Module Elements 


Solar array, propellant tankage, system 
communication, data management, displays/ 
controls, onboard checkout, pump-down 
accumulator, atmosphere supply, control 
moment gyros, guidance and control, hori- 
zon sensor, electrical power supply, 
reaction control 


command control console, gal ley/ wardroom, 
crew quarters, food storage 

Data evaluation, secondary and experi- 
ment control consoles, airlock chamber 
and controls, biomedical lab, optical 
lab, isolation and test lab, EVA airlock, 
airlock chamber, mechanical sciences lab, 
hard data processing facility, electrical/ 
electronics lab 

Propellant cargo, liquid and gas cargo, 
solid cargo, cargo handling aids, crew 
transfer tunnel, and airlock 


Figure 1-9. MDAC MSS Buildup Sequence/Initial Station 
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2.0 HAZARDOUS EARTH ORBITAL SHUTTLE PAYLOADS, 

CARGO TRANSFER, AND HANDLING 

Many different kinds of payloads wil] be carried into orbit in the orbiter 
cargo bay. The purpose cf this task was to identify, analyze, and recommend 
solutions of the hazards resulting from (a) the delivery, deployment, and 
retrieval of hazardous payloads, and from (h) the transfer and handling of 
general types of cargo. Three particular areas of concern were investigated 
since they concern the safety of the orbiter and its crew and passengers while 
in orbit. These are: 

o Upper stage vehicles as they are transported in the orbiter 
cargo bay, deployed, and retrieved. These vehicles include 
expendable stages, mainly using storable or solid propellants, 
and reusable cryogenic stages. Hazards specific to on-orbit 
orbiter aborts are included. 

o Hazardous fluid vessels transported and off-loaded in earth 
orbit in the orbiter as cargo or as part of a payload. 

Orbiter on-orbit abort hazards are included. 

o The handling and transport of cargo between the orbiter, sortie 
modules, and space station. 

It is believed that the assumptions inherent in this task are few and 
simple. These are: 

o The shuttle orbiter has the capability to operate in earth orbit 
independently of other vehicles in orbit, of the payload, or of 
the ground. 

o The orbiter has the inherent capability to return to earth with 
all its crew and passengers. 

o The orbiter payload or payloads are carried in a single cargo 
bay. This cargo bay is protected during boost and reentry by 
a cargo bay door or doors, which form a part of the orbiter, 
and can be opened and closed by the orbiter crew. The cargo 
bay is not pressurized or pressurizable in orbit. 

o The orbiter has the capability to deploy payloads out of the 
cargo bay, when required, and to retrieve and stow recoverable 
modules and payloads. 

o The orbiter and space station have docking capability. 
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So long as these assumptions remain valid, the results of this task 
should be applicable. In addition, assumptions applicable to specific 
hazards/emergency analyses have been recorded individually in the particu- 
lar analyses . 

2.1 CONCLUSIONS AND RECOMMENDATIONS 

The main outputs of this task are the safety requirements and guidelines 
which result from the hazard/emergency analyses. Conclusions from this task, 
based on the hazard/emergency analyses and other supporting analyses, are pre- 
sented in the following paragraphs. 

o The orbiter design is extremely sensitive to even small explosions 
in the cargo bay. Uncontained explosions equivalent to as little 
as 5 g (0.01 lb) of TNT may result in exceeding £he structural 
design limit of the cargo bay structure (14 kN/m , 2 psi) from blast 
overpressure. By comparison, a hand grenade is equivalent to 10 g 
(0.025 lb) of TNT and a fully loaded Centaur to approximately 
2700 kg (6000 lb) of TNT. 

o Any structural failure of a loaded upper stage vehicle while in 
the orbiter cargo bay which results in large leaks of both fuel 
and oxidizer will almost certainly be catastrophic to the orbiter. 

o The emergy content of even the smallest liquid propellant upper 
stage vehicle, if released suddenly, is far more than can be 
tolerated by the orbiter. The vehicle accelerations caused by the 
reaction of the leaking fluids will ensure mixing, and an ignition 
source will almost certainly be present during the process of 
structural failure. A chemical reaction therefore can be expected, 
and this will probably propagate faster than the rate at which 
the fluids can disperse in space, even with the cargo bay doors 
open. Every effort must therefore be made to prevent structural 
failure of upper stage vehicles while in or near the orbiter. 

Remedial measures are not considered practical, and have not been 
recommended . 

o If the leakage of large quantities of payload fluids into the 
orbiter cargo bay is considered credible during boost or while 
the orbiter is in orbit with the cargo bay doors closed, then 
additional venting of the cargo bay beyond that provided by the 
orbiter for normal venting may be required to avoid potential 
overpressurization of the cargo bay. This may need to be con- 
sidered and provided for individually for each payload which 
contains large quantities of fluids. 

o The chemical and physical behavior of gases, liquids, and cryo- 
genic fluids is not well understood in the zero-g and zero or 
very low pressure environment encountered in space. An important 
area of uncertainty as to the potential effects of leaking 
fluids therefore exists, and the severity, or even the possibility, 
of hazards such as combustion, chemical reaction, corrosion, 
attachment of frozen gases to the structure, etc., cannot be 
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properly evaluated at present. In the hazard /emergency analyses 
in this task, the worst-case assumption was made that effects 
which are theoretically possible, such as sustained combustion 
of leaking hypergolics, will indeed occur. 

o Launching a space station or sortie modules pressurized at 

1 atmosphere can present the orbiter with a considerable hazard. 

A typical station module of 140 m^ (5000 ft^) volume has an 
explosive potential of 10 kg (22 lb) TNT equivalent. This arises 
because of the energy which could be released in the vacuum envir- 
onment of space from the contained atmosphere. If this energy is 
instantaneously released, e.g., by structural failure of the mod- 
ule, the resulting blast am shrapnel would cause catastrophic 
damage to the orbiter. A rapid release of the contents of the 
module when the cargo bay doors are closed, without any blast 
effects, could still pressurize the cargo bay to about 20 kN/m^ 

(3 psi) , or about 50 percent above its present design limit. 

Rapid release of the module contents when the cargo bay doors 
are open, or a slow enough release so that the orbiter cargo bay 
vent system can adequately relieve the pressure, would not 
result in damage. 

o Many different fluids, of varying degrees of hazard and in varying 
quantities, are currently planned for transportation to and from 
space by the orbiter and for use in sortie modules and on the space 
station. While many general safety requirements and guidelines 
have been identified, and an adequate level of safety appears pos- 
sible to both the personnel involved and the spacecraft, more 
specific safety features than defined in this study must await a 
more detailed definition of the spacecraft, payloads, ard their 
planned operations than is currently available. 

o Cargo handling in space presents some specific hazards associated 
with the zero-g environment and with the limited remedial and 
escape provisions available. In addition to normal safety features 
required on the ground, specific requirements and guidelines, suc v 
as tethering of heavy cargo at all times, double-containing haz- 
ardous cargo, and pro /iding mechanical assist where propulsive 
forces are possible, have been identified. 

The main recommendations from this task are contained in the safety re- 
quirements and guidelines developed during the hazard/emergency analyses. 
Specific top-level recommendations arising from these and from supporting 
analyses are described in the following paragraphs. 

o The cargo bay doors on the orbiter should be opened as early as 
possible and closed as late as possible while in orbit when haz- 
ardous fluids or large quantities of propellants are carried in 
the orbiter cargo bay. This minimizes hazards from leakage, 
explosions, contamination, etc. 

o The liquid contents of upper stage vehicles being returned to 
earth should be dumped to space before deorbiting the orbiter. 

The purpose is to avoid the possibility of an uncontrolled 
increase in internal upper stage vehicle pressure during reentry 
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or on the ground, possibly from an unexpected heat leak. The 
acceptable level of residual liquids and gas before returning 
to earth should be such that an insulation failure, leakage, 
or a crash landing will not result in overpressurization, fire, 
or a similar accident. 

o The capability should be provided for the orbiter to deorbit, 
reenter, and land with a fully loaded upper stage vehicle. 

This condition may arise from a failure to deploy the upper 
stage vehicle (perhaps because of lack of time following an 
abort situation) and failure to dump upper stage vehicle pro- 
pellants. While such a combination of events may be quite 
improbable, the consequences could be catastrophic, and the 
condition should be designed for as being credible. It is 
not recommended that reduced factors of safety be con- 
sidered for this situation, but the reentry and landing load 
criteria should be less severe than the normal design cases 
(e.g., 2 <r conditions instead of 3 or) for this maximum weight 
condition, to avoid combining unrealistically severe worst- 
case design cases. The pilot in such situations will undoubt- 
edly take extra care to avoid a hard landing. 

o Upper stage vehicles must be man-compatible; i.e., man rating 
safety criteria must be applied to systems and functions of the 
upper stage vehicle which could create a hazard to the orbiter 
while the upper stage vehicle is in or near the orbiter. These 
criteria, which are not currently defined, must be defined con- 
sistently for the shuttle and for upper stage vehicles. One 
possibility is that a flight test of the upper stage vehicle be 
performed in the shuttle using fluids which are physically 
similar to the propellants but which do not react chemically. 

For example, LN2/LH2 may be used to simulate LO2/LH2. Such a 
flight test may be cost-effective because it can also replace 
much of the ground qualification testing. 

o Because of the criticality to the orbiter of a failure of a 
pressurized sortie or space station module in the cargo bay 
while in space, two areas should be studied further: 

. Identify and eliminate failure modes which can cause major 
structural or other failures of pressurized sortie or 
space station modules during boost, on-orbit, and reentry 
phases . 

. Consider venting the modules to space while they are still 
in the cargo bay, to reduce the explosive potential. The 
necessary atmosphere can be taken up in a number of high- 
pressure tanks within the module. This has the effect of re- 
ducing the potential for damage, both by reducing the energy 
content per tank, and by reducing pressure that can be 
generated in expanding the gas from a ruptured tank to the 
cargo bay volume. 
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2.2 RESIDUAL HAZARDS AND HAZARDS RESOLUTION 

This section summarizes the hazards identified and their resolution, and 
presents the resulting requirements for supporting research and technology. 

2.2,1 Resolution of Identified Hazards 


The disposition of the 25 hazards identified is shown in Table 2-1 • This 
shows the judgments of the investigators as to which hazards would be resolved 
by implementation of the recommended requirements and guidelines, and which 
are residual hazards; which of the residual hazards represent acceptable risks; 
and which require supporting research and technology (SRT) or must at present 
be considered unresolved safety issues. 

2.2.2 Supporting Research and Technology Requirements 

The supporting research and technology requirements resulting from the 
areas of uncertainty of this task are listed below (the main originating 
hazards/emergency are indicated in parenthesis): 

o The behavior of pressurized cryogenics, gases, and liquid as they 
explode into vacuum or into a large evacuated container should be 
understood. The purpose would be to determine the explosive con- 
tents under different conditions and the damage that can result. 

The subject can initially be studied analytically and the key 
results verified by laboratory tests (1.1001, 1.2.005). 

o Current and new techniques for designing, constructing, and oper- 
ating tanks which can fail under pressure without producing 
shrapnel should be pursued (1.1001, 1.2.005). 

o The use of strain measurements on pressurized tanks should be 
explored as a means of detecting impending failures on the 
tanks. This method has the potential advantage over conven- 
tional methods of monitoring temperatures and pressures of the 
contents that it can detect failures of the tank due to imper- 
fections or weaknesses of the tank, as well as overpressuriza- 
tion (1.1.001, 1.2.005). 

o The potential for chemical combination of mutually reactive 
fluids and decomposition of monopropellants in zero-g and low 
to zero pressure environment should be investigated to evaluate 
how severe this hazard is. Some insight can be gained by 
theoretical studies, but full confidence would require small- 
scale laboratory tests in simulated or actual zero-g conditions. 

For monopropellant decomposition, the catalytic effect of dif- 
ferent spacecraft materials should be investigated, as well. 

This would require valid pressures, temperatures, and concentra- 
tions, but the zero-g environment could probably be dispensed 
with except as a final verification (1.1.002 and 1.1.003). 
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Table 2-1.. Hazards Resolution 
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Hazard No. 

Hazard 
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Risk 
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Residual 

•H 
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V 4J 
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PC 

IT 

Unresolved 

Safety 

Issue 

1.1.001 

Explosion/rupture of a pressurized 
container in an upper stage vehicle 
inside or near shuttle. 


X 


X 

X 

1.1.002 

Combination of mutually reactive 
upper stage vehicle fluids in 
explosion or fire inside or 
near shuttle. 


X 


X 

X 

1.1.003 

Detonation of explosive charge on 
upper stage vehicle inside or 
near shuttle. 

X 





1.1.004 

Rapid decomposition of mono- 
propellants located in or 
leaking from the upper stage 
vehicle while inside or near 
shuttle . 


X 


X 


1.1.005 

Uncontrolled combustion in active 
upper stage vehicle reaction 
control engines while near the 
shuttle. 

X 




i 

1.1.006 

j 

Leakage of corrosive fluids from 
upper stage vehicle tanks while 
inside the orb iter. 


X 


X 


i 

j 1.1.007 

Inadvertent start of an upper 
stage vehicle rocket engine while 
inside shuttle cargo bay. 


X 

X 



1.1.008 

Inadvertent separation of any part 
of upper stage vehicle while 
attached to the shuttle. 


X 

X 



1.1.009 

1 

Loss of attitude/translation 
control of upper stage vehicle 
upon release from shuttle. 

i 

i 

X 

! X 



! 

1.1.010 
1 

Hangup of upper stage vehicle 
during release from shuttle. 

X 

i 

j 
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Table 2-1. Hazards Resolution (Cont) 
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1 . 1.011 


1 . 1.012 


1.1.013 


1.1.014 


1.1.015 


Rupture of common bulkhead tanks in 
upper stage vehicles; while in or 
near shuttle. 

Loss of pressurization in pressure 
stabilized upper stage vehicle 

Inability to dump propellants of 
pressurants in retrieved 

Inability to dump upper stage vehicle 
propellants or pressurants during 
shuttle abort. 

Inability to close cargo bay doors 
after retrieval of upper stage 
vehicle because of interference 
with upper stage vehicle. 


1 . 2.001 


1 . 2.002 


1.2.003 


1.2.004 


Exposure of the shuttle crew or 
passengers to a toxic environment 
released from a vessel in the payload 
containing a toxic fluid. 

A fire in the cargo bay resulting from 
release and ignition of a flammable 
fluid in an unpressurized paylaod. 

A fire in a pressurized payload in the 
cargo bay resulting from release and 
ignition of a flammable fluid. 

A corrosive environment in the shuttle 
cargo bay resulting from leakage or 
rupture of a payload vessel containing] 
a corrosive fluid. 
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Table 2-1, Hazards Resolution (Cont) 
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1.2.005 An explosion in the shuttle cargo bay 
of a potentially explosive paylcad 
vessel. 


1.3.001 Spillage or leakage of hazardous fluid 
or material during manual transfer in 
pressurized modules. 

1.3.002 Spillage or leakage -'f hazardous fluids 
or materials during mechanically 
assisted or remote transfer in 
pressurized modules. 

1.2.003 Spillage or leakage of hazardous fluid 
or material during remote transfer in 
unpressurized area. 

1.3.004 Failure of transfer mechanism and/or X 
loss of control of cargo during 
transfer in pressurized or un- 
pressurized areas. 

1.3.005 A radioactive environment in a sortie 
module or space station, resulting 
from exposure or escape of radioactive 
material during ransfer and handling 
of radioactive materials. 
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o The behavior of corrosive fluids in zero g should be investigated 
to determine how serious the hazard of a leaking corrosive fluid 
could be, and to determine practical protection methods and remed- 
ial measures. Means for detecting the location of the corrosive 
fluid or of the corrosive action should also be investigated* This 
research should cover the range of pressures from full spacecraft 
pressures down to a vacuum. A particular point to be investigated 
should be the behavior of corrosive fluids which are frozen in a 
space environment and thaw out and become more active upon return 
to an earth environment (1.1006, 1.2.004). 

o The flammability and chemical reactivity of spacecraft and payload 
materials under low pressure conditions representative of fluid 
leakage into the orbiter cargo bay should be investigated. The 
reactive gases should be fluids such as oxygen, hydrogen, N2O4, 
etc*, which may be carried as propellants, cargo, or experiment 
fluids. The purpose would be (a) to understand the mechanics and 
dynamics of chemical reactions under zero-g and low-pressure con- 
ditions, and (b) to map areas of flammability and reactivity in 
terras of materials, pressures, temperatures, etc*, for use as a 
guide in material selection for forthcoming spacecraft (1.2.002). 

o Means for detecting and suppressing fires in a zero-g pressurized 
environment should be investigated. This research should include 
understanding of ignition, heat transfer, and flame propagation; 
effects of air currents due to forced convection and low-g accel- 
eration; and the convection effects of applying fire extinguishers 
to the fire* Both manned and unmanned situations should be con- 
sidered. The investigation should consider a broad systems 
approach to the problem so as to lead to practical recommendations 
for space applications. Tests should be considered for the Sky lab 
program to supplement the current proposed effort (1*2*003). 

o Means should be developed for locating spilled hazardous fluids 
and materials in a zero-g manned environment and for neutralizing 
or collecting and disposing of these (1.3.001, 1*3.002). 

2.3 UPPER STAGE VEHICLES AS SHUTTLE PAYLOADS 

The purpose of this subtask was to identify the hazards associated with 
the transportation, deployment, and retrieval in earth orbit of upper stage 
vehicles, and to determine the safety measures required to deal with these. 
Both expendable stages and reusable stages were considered. Hie orbiter on- 
orbit abort hazards subsequent to these types of payloads were also analyzed. 

A large range of upper stage vehicles, identified below, is currently 
being considered for use in the shuttle orbiter. These stages will be used to 
launch unmanned payloads into higher orbits than the orbiter capability. 
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2.3.1 Hazardous Elements of Upper Stage Vehicles 

The upper stage vehicles considered in this subtask were: 

o Agena 
o Centaur 
o Transtage 
o Burner II 

o Apollo service module 
o Orbit-to-orbit shuttle (OOS)/tug 

It is believed that the hazards identified from these vehicles are typical 
of all upper stage vehicles that may be carried in the shuttle orbiter in the 
foreseeable future. The modified versions of the Agena and the Centaur as 
presently conceived differ only in the sizing of the tanks. The subsystems 
will be the same as on the current stages. Ihe 00S and the tug at the time 
this report was prepared were in Phase A definition and therefore exact data on 
the subsystems to be used are not available. Hcwever, the results of the Phase A 
studies at North American Rockwell indicate that the OOS/tug hazards are fully 
covered by the other vehicles considered. 

Hazardous elements of the upper stage vehicles considered are listed in 
Table 2-2. 

2.4 HAZARDOUS FLUID VESSELS AS SHUTTLE PAYLOADS 

In general, hazards exist either because the fluid is inherently hazard- 
ous, e.g., toxic or corrosive, or because of the conditions under which it is 
transported; e.g., at high pressure or as a cryogen. The shuttle crew or 
passengers are normally only directly exposed to the hazard when a manned 
pressurized experiments module is carried on the orbiter as part of a sortie 
module. Situations in which crew or passengers have exposed themselves to the 
hazardous fluids in extravehicular ictivity (EVA) have also been considered. 

The main safety concern has turned cut to involve damage to the orbiter, par- 
ticularly the cargo bay area; and this, of course, jeopardizes personnel 
safety indirectly by precluding return to earth. 

A major area not covered in this study is the transportation into space 
by the shuttle of large quantities of propellants fcr logistic resupply of 
such vehicles as a tug, orbital propellant depot, and chemical or nuclear 
propulsion stages. The reason is that the en: ire subject of logistics resupply 
of propellants and propellant transfer is being studied in a concurrent NASA 
study at the Space Division, In-Space Propellant Logistics and Safety Study, 
Contract NAS8-27692. Project II of this study is specifically concerned with 
the safety aspects. 
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Table 2-2. Hazardous Elements of Upper Stage Vehicles 


Centaur 


Fluid Propellants: 


Nitrogen Tetroxide 
Aerozene -50 
Hydrogen Peroxide 
Liquid Oxygen 
Liquid Hydrogen 
Monomethyl Hydrazine 
Water/Glycol 
Unsymnetrical Dimethyl 
Hydrazine 

Inhibited Red Fuming Nitric 
Acid 

Pressurized Containers: 


Helium Tanks 
Nitrogen Tanks 
Nitrogen Tetroxide Tanks 
Aerozene -50 Tanks 
Hydrogen Peroxide Tanks 
Liquid Oxygen TanP.s 
Liquid Hydrogen Tanks 
Monomethyl Hydrazine Tanks 
Kater/Glycol Tanks 
Unsymmetrical Dimethyl 
Hydrazine 

Inhibited Red Fuming Nitric 
Acid 

RCS Propellants: 


Aerozene -50 + Nitrogen 
Tetroxide 

Monomethyl Hydrazine + 
Nitrogen Tetroxide 
Hydrogen Gas ♦ Nitrogen 
Tetroxide 

Corrosive Fluids: 


Nitrogen Tetroxide 
Hydrogen Peroxide 
Liquid Oxygen 
Inhibited Red Fuming Nitri 
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Table 2-2. Hazardous Elements of Upper Stage Vehicles (Cont) 



Connections Between Modules - 
Cutters 
Helium Valves 
Solid Propellant Igniters 
Turbine Start Solid Pro- 
pellant Charges 
Explosive Bolts - Payload 
Separation 

Linear Shaped Change - Panel 
Separation 

Destruct Shaped Charges 
External Extensions - 
Antennae 

Rocket Engines : 

(Qty. Indicated) 

Main Engine 
RCS Engine 

Stability Source : 

Gyro Reference 
Accelerometers 
Computer/Flight Control 

Attachment Metnods : 

Explosive Bolts 
Linear Shaped Charge 
Not Defined 

Attitude Hold/Translation 


apabilities : 

Translation - Main Engine 
-RCS 

- Auxiliary 

Attitude Hold - RCS Couples 
- Off-Center 

* ( ) Number of directions 


Agena 

Centaur 

Transtage 

Burner II 

SM 





X 

X 


X 

X 


X 





X 

X 

X 

X 

X 

X 

X 



X 

X 

X 

X 

X 

V 
- \ 





Y 

1 

2 

2 

1 

1 


8 

12 

4 

lb 

X 

X 


X 


X 

X 




X 

X 


X 





X 


X 

X 

X 


X 

x(D* 

X(1) 

X(l) 

XU) 

xci; 



X(l) 

X (2) 

X(6) 


X(1) 



X 

X 

X 

X 

X 
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The following section identifies hazardous fluids involved in the 
orbiter pavloads (except upper stage vehicles) . 


2.4.1 Hazardous Experiment Fluid s 

Hazardous experiment fluids were identified by a review of Volumes II 
through VIII of the "Blue Book", (Ref. 1). This document was selected 
because it is used as a baseline NASA document to define a manned space- 
flight research capability to be conducted in earth orbital space stations 
and shuttles and is therefore not oriented specifically to any single 
program. 

The results of the Blue Book review are summarized in Table 2-3. 

2.4.2 Hazardous Sortie Module Fluids 


Sortie modules include research and applications module (RAM), RAM 
support module (RSM), mission support module (MSM), and palletized experiment 
payloads which remain attached to the orbiter and are used as reusable space 
laboratories or support facilities. 

For a typical seven-day experiment sortie mission, it will require fluids 
in the approximate quantities and with approximate container characteristics 
as listed in Table 2-4. 

Hazardous fluids other than those applicable to sortie missions which 
were identified during review of the 1971 NASA Experiment Blue Book were not 
identifiable. 

2.4.3 Hazardous Station Fluids 

Hazardous fluids are required by both the SD and McDonnell Douglas (MDAC) 
designs of the modular space stations during the station buildup and normal 
operations phases. Station modules containing hazardous fluids for attitude 
control, electrical power generation, and pressurization will be delivered by 
the shuttle during the buildup phase. Resupply of station subsystem consum- 
ables will be accomplished under the present concepts via an orbiter delivered 
cargo or logistics module. 

The SD station is planned to generate GO 2 and GH 2 by water electrolysis 
during normal operations. During buildup, it requires delivery of high- 
pressure gases on the initial modules to support subsequent buildup operations. 
After station buildup, delivery of water for electrolysis and GN 2 for atmos- 
phere leakage makeup via the cargo module will be the primary station subsystem 
resupply fluids. The expected fluid quantities, tank, quantities, and pressures 
for the SD station core and power module buildup launches and the cargo module 
resupply for station subsystems are shown in Table 2—5. This includes fluid 
quantities required for station repressurization, EVA support, and 48-hour 
emergency support. 
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Table 2-3. Summary of Hazardous Fluid Vessels in Orbiter Payloads 



HAZARD 

PROGRAM ELEMENT 

UPPER STAGE 
VEHICLE 

BLUEBOOK 

EXPERIMENT 

OTHER 


Toxicity 

Fire 

Corrosion 

Explosive 

Agena 
Centaur 
Burner II 
Transtage 

Service Mod. /Apollo 
OOS/Tug 

Astronomy 

Physics 

Earth Observation 
Comm./Nav. 

Mater. Sci . 5 Proc. 

Technology 

Life Sciences 

Space Station (NRj 
Space Station (MDAC) 
RAM Support Module 
Automated Payload 

HAZARDOUS FLUID 

CRYOGENICS 





ln 2 

B 


X X X 

X 

LO? 

B X X X 

X XX 

X 

X 

LH e 

B 


X X 


lh 2 

B X X 

X XX 

X 

X 

Slush Hydrogen 

B X X 


X 


Solid Cryogen 

B 


X 


Undefined Cryogen 

B 


X X 


LN e 

B 


X 


LA r 

B 


X 


Superfluid Helium 

B 


X 


Dry Ice (LCO2) 

B 


X 


GAS 





°2 

X X X x 


X XXX 

X X 

n 2 

A 

X XXX 

X ' X 

X X X X 

H2 

XX X 



X 

Unspecified Gas 



X X 


H e 

A 

XX XX 

X X 


Hydrocarbons 

X X 


X 


Carbon Tetraflouride (CF4) 

X 


X 


Carbon Monoxide (CO) 

XX X 


X 


Carbon Dioxide (C0 2 ) 

A 


X 

X 

Nitric Oxide (NO) 

C X 


X 


Acetylene (HC = CH) 

AX X 


X 


Diborane ^H^) 

XX X 


X 


Xenon (X e ) 

c 


X 

1 

Footnotes: A - Simple asphyxiant 

C = Extremely toxic when 

B * Can cause severe burns 

and heated to decomposition 

tissue damage on contact X - Applicable or present 

| with skin 
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Table 2-3. Summary of Hazardous Fluid Vessels in Orbiter Payloads fCont) 


HAZARDOUS FLUID 


GAS (Continued) 

Sulfur Hexaflouride (SF6) 
Methane (CH4) 

Propane (CH3CH2CH3) 
Unspecified Combustibles 
Hydrogen Sulfide (H^S) 

LIQUID 


HAZARD 


PROGRAM ELEMENT 


UPPER STAGE 
VEHICLE 


v 00 

•rl Q) U r-» 

x u u a 

o o x 

H ^ O W 


T) 

o 

»-• S 

l— » DO 

Jh 03 a> DO 

D <-* o p 

cd a3 o </) -H H 

C ^ C C >\ 

(D C H 03 ^ (O 

DO <D P 0) O 

< U cQ H (/) O 


BLUEBOOK 

EXPERIMENT 


cd uST (/) 

> a> 

f-i • o 

• -h x C 

X 10 > O DO <D 

e x> cd 00 o *h 

o </> o •-* o 

co s • o w 

O -h x • ^ c 

H t/3 +-> E 1) X ,0) 

X Jh gw O 

in x cd o jd <d *h 


u!X t/> 

a> 

• o 

•H X C 
O DC <D 
00 O *H 


LU (J S h j 


OTHER 



Hydrazine (N2H4) 

Nuclear Emulsion 
Hydrocarbons 

Trimethlaluminum (AL (CH 3) 3 *) 

Freon 

Mercury 

Phenol (C6H5OH) 

Formaldehyde 
Liquid Metals 
Potassium Sodium Niobate 
Potassium Sodium Silicate 
Solvent 

Gallium Arsenide Solution 
Liquid Gallium 
Fused Silicate Solutions 
Hexane (CH3(CH2'! 4CH3) 
Methanol (CH3OH j 
Pentane (CH 3 (CH2) 3CH5) 
Ethanol (CH3CH2OH) 

Freon II 
Freon II 4 B 2 
Freon 21 
Glycol 


1 X X X 
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Table 2-3. Summary of Hazardous Fluid Vessels in Orbiter Payloads (Cont) 




PROGRAM ELEMENT 



HA2ARD 

UPPER STAGE 
VEHICLE 

BLUE BOOK 
EXPERIMENT 

OTHER 


C V 

O 

*— 4 
1— « 

O 

Cu 

< 

*0 

0 

w (U 2 

♦ 

O 

c 0 

0 u 

*H O. 

ctt usr ca 

> <D 

U • O 

<U • *H X C 
X ifl > O WH) 

Space Station (NR) 
Space Station (MDAC) 
RAM Support Module 
Automated Payload 

HAZARDOUS FLUID 

Toxic itj 
Fire 
Corrosic 
Explosi\ 

Agena 

Centaur 

Burner ] 

Transtaj 

Service 

OOS/Tug 

Astronor 
Phys ics 
Earth 01 
Comm./Nc 
Mater. S 
Techno 1c 
Life Sci 

LIQUID (Continued) 

IITRI ZNO Silicone (S-13) 
IITRI ZNO Silicate (Z-9) 
LMSC Thermatrol T 1 P 2 
Silicone (c\-100)^ 
Schteldahl GT-.015 
Lubri cants 
Hydroquinones 
C 2 H 4 

Nitrogen Tetroxide (N? 04 ) 

1 

X x 
X X 
X X 

X X 
X X 

X X X 
X 

X X 

X XX 

X 

X 

X 

X 

X 

X 

A-SO (50°6 UDMH + 50 ? o " 

C X X X 

X XX 


X 

Hydrazine) 

Hydrogen Peroxide (H 2 O 2 ) 

X X X X 

X X 


X 

Monomethyl Hydrazine 

C X X X 

X 


X 
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Table 2-4. RAM Support Module Fluids for Seven-Day Mission 


Fluid 

Fluid 
Quantity 
kg (lb) 

Container 
V o lum e 
m3 ( ft 3j 

No. of 
Containers 

LO 

310(680) 

0. 23 (7. 1) 

2 

LH 

34(75) 

0. 36 (12. 6) 

2 

ln 2 

60(133) 

0. 23 (8. 1) 

1 

gn 2 

4. 5(10) 

Not defined 

Not defined 


Table 2-5. Expected Hazardous Fluids - NR Modular Station Subsystems 



CORE 

MODULE 

POKER 

MODULE 

CARGO 

MODULE 


Container Characteristics 

Container Characteristics 

Container Characteristics 

Fluid 

Fluid 

Qty 

kg(lb) 

Qty 



Vol 

m3(ft3) 


Qty 

Vol 

m^(ft3) 


Qtv 

Vol 

m3 ( ft 3) 

go 2 

146(322) 

■ 

0.15(5.3) 

125(274) 

3 

0.15(5.3) 

88(194) 

2 

0.31(10.9) 



■ 


88(194) 

3 

0.31(10.9) 

64(141) 

i 

0.22(7.9) 

gh 2 

18(40) 

B 

0.31(10.9) 

15(34) 

3 

0.31(10.9) 

3.2(7) 

3 

0-21(7.6) 

gn 2 

l 


B 


58(127) 

3 i 

i 

3.24(8.6) 

1 

73(161) 

6 

0.31(10.9) 


All pressures 2.06 x 10 7 N/m- (3000 psi). 
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2.5 CARGO HANDLING AND TRANSPORTATION BETWEEN SHUTTLE ORBITER, SORTIE 

MODULES, AND SPACE STATION 

The purpose of this subtask, was to identify the hazards associated with 
the handling and transportation of cargo between the shuttle orb iter, sortie 
modules, and space station in earth orbit, and to determine the safety 
requirements and guidelines to deal with these hazards. 

Table 2-6 shows the cargo that is needed for space station operations, 
including hazardous cargo. The cargo that has to be transferred between the 
various spacecraft in the mission model are shown in Table 2-7. 


Table 2-6. Space Station Logistics Resupply 


Cargo Item 

Cargo Item 

* Liquid hydrogen 

Film-35 mm cine 

* Liquid oxygen 

Film-70 mm 

* Liquid nitrogen 

Film-150 mm 

* Liquid helium 

Film-225 mm 

* Miscellaneous cryo 

Film 16 mm 

* Atmosphere 

Film-9 x 14 mm 

* Argon 

Cultures (food) 

* Neon 

Specimens and food 

* Helium 

Food (animals) 

* Carbon dioxide 

Tape, video 

* Oxygen 

Tape, audio 

* Nitrogen 

Tape and microfilm 

* Calibration gas 

Magnetic tapes 

* Miscellaneous cryo 

Specimens spares 

Water-animals 

Logistics 

Water-no metallic content 

Micrometeroid collector 

Water-sterile triple 

Ballooms 

distilled 

Dry samples 

Photo process chemicals 

Diary, logistics 

Emulsion 

Lab supplies 

Chemicals 

Physiological Measurement 

Film- 35 mm 

supplies 

* Hydrazine 

Accessories 

Life support 

Film plates 

Service items 

Probes 

Station spares 

Waste (return) 

* Hazardous Items 




i 


I 


l 


i 





Table 2-7. Cargo Handling and Transfer Model 


EOS* Crew Compart- 
ment or Airlock 


*EOS + Propellant 
Tanks 


RAM X Support Module 


Experiment Pallet 


RAM X (7-30 Da 
Sortie) 


RAM X (Free Flyer) 
Space Station 


Space Station 
Cargo Module 

Mission Support/ 
Adapter Module 


USV (Upper Stage 
Vehicle) 


USV Payload 


E0S + Serviceable 
Automated Payloads 


N.h'N.H N,n 


Legend: N = Non-hazardous cargo (film, tape, service items) 

H = Hazardous cargo (propellants, hazardous fluids and materials) 
- = Not applicable or no cargo transfer 

Notes: * Considers potential payload use of EOS reserve propellants 

** Considers potential use of EOS propellants stored in cargo bay 
to extend EOS capability 
+ EOS = Earth Orbital Shuttle (orbiter) 
x RAM = Research Applications Module (sortie module) 

° USV = Upper Stage Vehicle 




[tliE 


Automat 
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Potential hazards which can occur during cargo handling and transfer 
operations were identified by considering possible combinations of the follow- 
ing: 

o Candidate cargo, both hazardous and nonhazardous 
o The cargo handling and transfer model 
o The different methods of cargo handling and transfer 

The hazards or emergencies were considered to arise from two source, as 
follows : 

o Failures or accidents related to hazardous cargo items in 
otherwise normal handling and transfer operations 

o Malfunctions, failures, or accidents related to the cargo 
handling and transfer mechanisms, including human errors, 
considering both hazardous and nonhazardous cargo 

Maximum Safe Tank Contents 


Gaseous leakage from a pressurized tank into the orbiter cargo bay cannot 
be allowed to overpressurize the bay. The resulting damage to the sh*-tle 
structure and cargo bay doors could, in extreme cases, cause loss of Jie entire 
vehicle, including the crew, during reentry. Limiting the gaseous contents of 
any one tank to the value shown for a typical case in Figure 2- ' will prevent 
overpressure in the event of rup'ure. This result takes advantage of the 
decrease in gas temperature during expansion to allow high initial tank pres- 
sures in relatively small tank volumes. The final low temperature reduces the 
immediate specific volume, so that a larger weight of gas is acceptable to the 
shuttle structural strength. It is therefore better, from the point of view of 
potential cargo bay overpressurization, to transport large quantities of gas in 
the orbiter cargo bay at high rather than low pressure (assuming the same stor- 
age temperature) . 


3 -a 

For example, a typical space station module contains 156 m (5500 ft J ) of 
air at 10^ N/m^ (14.7 psi). This point is on the unsafe side of the curve, 
i.e. , a massive leak from the module could damage the orbiter cargo bay. If 
the same quantity of air is stored in a tank of 1.56 m^ (55 ft^) at a pressure 
of 107 N/m^ (1470 psi) , and the module is now vented to space during launch 
and only pressurized after station assembly, a rupture of the tank will not 
now overpressurize the cargo bay, as shown by the fact that this point now 
lies on the safe st.de of the curve. 

Maximum Safe Tank Contents - Liquid 

Safe liquid content of upper stage vehicle tanks is a function of the 
amount of gas generated when liquid leakage occurs. ’ Storable propellants 
release a small amount of gas because of rapid solidification. The differ- 
ence between solidification temperature and normal operating temperature is 
small and the heat lost through evaporation is large, e.g., one pound of 
water at 2l°C (70°F) requires only 0.073 kg (0.16 lb) of water evaporation to 
freeze. In contrast, cryogenic propellants vaporize a larger percentage of 
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the liquid before the remainder is solid; e.g., at least 25 percent for hydro- 
gen and 53 percent for oxygen. Expansion to a higher pressure than vacuum 
may result in a decrease in the amount of gas generated, but at a higher temp- 
erature. Specific analysis is required for each combination of liquid and 
storage conditions to identify safe liquid tanks volumes. 


Ft 


3 


3530 


Tank 

Volume 


353 


55.3 



1 


10 ! 

10- s 

100 

10" 

N/m^ abs 


Initial 

Tank Pressure 



1.4 5 

14.5 

145 

1450 

psi 


Figure 2-1.. Safe Content of Gas Tanks 


The TNT equivalent of hydrogen (parahydrogen) as it expands from typical 
subcritical conditions to vacuum is shown in Figure 2-2, as being typical 
of cryogenic fluids. This is plotted against the temperature of the fluid. 

The initial conditions on the right all represent different combinations of 
temperature and pressure, with the fluid fully saturated; i.e., 100 percent 
gas for the two top curves, and 100 percent liquid for the two bottom curves. 

The four curves are characterized by the entropy, which is assumed to remain 
constant during expansion. The variation of the corresponding "quality", or 
proportion of gas, during the expansion is shown for the four curves in Fig- 
ure 2-3. 

If the expansion starts or terminates at pressures and temperatures within 
the range shown in Figure 2-2, the TNT equivalent of the expansion is repre- 
sented by the difference in ordinates for the two points* Since in practice, 
expansions of interest neither proceed to a vacuum, nor proceed isentropically , 
it is seen that the curves indicate the maxiraun potential TNT equivalent 
(remembering that entropy can only increase during a real process, not decrease). 
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It is also of interest to note how nonlinearly the pressure decreases 
with the temperature, as shown by the bottom scale of Figure 2-2. 

Typically, the TNT equivalent of cryogenics is relatively low. As a 
comparison, Table 2-8 compares th ". TNT equivalent of hydrogen at typical 
subcritical cryogenic storage conditions as a liquid, with the same tempera- 
ture and pressure as a gas, and with typical high pressure storage conditions 
as a gas at room temperature. 


Table 2-8. TNT Equivalent of Hydrogen Stored at Typical Cryogenic 
and High Pressure Gas Conditions 


Pressure 

Atm. 

Temperature 
°K (°R) 

Phase 

TNT Equivalent 
kg/kg H 2 ( lb / lbl 1 2 ) 

Expanding to 
1 Atm. 

Expanding to 
Vacuum 

6.8 

29 (52) 

Liquid 

0 .006 

0 .056 

6.8 

29 (52) 

Gas 

0 .031 

0 .134 

20.4 

294 (530) 

Gas 

0.52 

0.75 


Bias t Overpressure 

Face and side on overpressures resulting from an explosion are shown in 
Figure 2-4 as a function of blast source TNT equivalent and distance from 
the source. 

The maximum allowable cargo bay pressure for a typical orbiter design of 
13,800 N/m2 (2 psi) is shown for reference together with the maximun allowable 
face-on overpressure, 20,700 N/m^ (3 psi), permissible for personnel exposure 
without additional protection. 

The figure shows that considerable cargo bay damage could result from an 
uncontained explosion within the bay with less than 0.0045 kg (0.91 lb) TNT 
equivalent. For example, if a blast of this energy equivalent were detonated 
in the center of a 4.6 m(15 ft) diameter by 18.3 m (60 ft) length cargo bay, 
the structure located at a distance of 2.3 m (7.5 ft) would be exposed to an 
overpressure in excess of 69,000 N/m^ (10 pci), while the ends of the bay 
would be exposed to slightly greater than 6900 N/m^ (1 psi). 

Figure 2-5 shows the TNT equivalent per unit volume of diatomic gases as 
a function of pret- ur*. 
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Maximum Tolerable Leak Rate into Shuttle Cargo Bay 

An investigation was made to determine the maximum allowable leak rate 
which can be tolerated into the shuttle cargo bay from a pressurized payload 
vessel. The shuttle cargo bay doors were assumed to be closed and the bay 
provided with vents to limit cargo bay differential pressures to less than 
13,800 N/m 2 (2 psi), A vent area to cargo bay volume ratio of approximately 
13.8 cm^/m^ (0.06 in^/ft^) which has been previously used in NR shuttle venting 
studies, was assumed to estimate the venting area for any known cargo bay vol- 
ume. 


The maximum tolerable leak rate as a function of vent area is shown in 
Figure 2-6 and assumes a gas temperature of -205°C (-328°F) 

(typical temperatures of gases that have leaked into the cargo bay), a maxi- 
mum allowable cargo bay differential pressure of 13,800 N/m^ (2 psi), and a 
discharge coefficient for the vent of 0.85. The leak rate is relatively 
insensitive to the gas temperature, varying inversely as 'the square root of 
the absolute temperature. 

It is seen that the maximum leak rate which can be tolerated is larger 
for gases of high ^olecular weight than gases of low molecular weight, and 
that leakage of hydrogen represents the worst case. 

Current NR orbiter designs use always-open cargo bay vents of approxi- 
mately 0.37 (4 ft^) area. The maximum tolerable steady state leakage rate 

into the cargo bay, with doors closed, is of the order of 2.5 kg/sec (5.5 lb/ 
sec) for hydrogen and 20 kg/sec (45 lb/sec) for air, oxygen or nitrogen. 

Larger leakage rates into the cargo bay can be tolerated for shorter durations, 
until the cargo bay pressure goes from vacuum to the tolerable limit. Such a 
large leakage rate for a prolonged period io approaching, in its damaging 
effects, an explosive rupture of a tank rather than leakage. 

It can be concluded that overpressurization of the orbiter cargo bay for 
normal cargo is not a major hazard. It must be considered, however, for pay- 
loads containing mostly propellants, such as upper stage vehicles or propellant 
logistics resupply. The hazard is then serious, however, only during the time 
the cargo bay doors remain closed. 

Man-Compatibility of Tug while in or Near Orbiter 

Upper stage vehicles must be man-compatible; i.e., man rating safety 
criteria must be applied to systems and functions of the upper stage vehicle 
which could create a hazard to the orbiter while the upper stage vehicle is 
in or near the orbiter. The term man-rating, while not strictly defined, 
means that the safety, i.e., lack of hazards to the shuttle and shuttle 
personnel, has been adequately demonstrated so that the residual risks to 
personnel are judged to be acceptable. This is, of course, a subjective matter 
and no definite man-rating criteria can be cited. 

On the Saturn S-II and Apollo CSM programs, two successful unmanned flights 
were the last phases of man-rating a new launch vehicle. It is not clear what 
the equivalent requirement is for upper stage vehicles, since the mission phases 
which require man-compatibility are the relatively passive phases of launch, 
boost, on-orbit deployment and retrieval, deorbit, reentry, and landing. 
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The test requirements for man-compatibility must therefore be developed, 
and must be consistent with the corresponding man-rating requirements on the 
shuttle. 

One possibility is that a safe unmanned test be performed on the shuttle, 
in which one or both propellants are replaced by equivalent fluids which cannot 
react chemically. For example, LO 2 /LH 2 vehicles may be launched into orbit and 
returned to earth using The liquid nitrogen will provide an adequate 

simulation of the liquid oxygen, but neither the nitrogen nor the hydrogen on 
their own, nor in combination, can produce a chemical reaction. Other propel- 
lants can be replaced by chemically inert fluids with analogous density, 
thermal, and other properties. Such a flight test can be used to satisfy man- 
compatibility requirements; but it can also be used as a part of tne vehicle 
qualification testing because the shuttle environment is perfectly reproduced. 
Such combined testing may prove very cost effective, replacing a large portion 
of the ground qualification testing, as well as satisfying the man-compatibility 
requirement. 

An alternative man-compatibility test may consist of launching the upper 
stage vehicle into orbit as a kickstage, using a booster which exhibits environ- 
ments at least as severe as the shuttle. Such a test imposes design constraints 
on new upper stag* vehicles (i.e., the tug/OOS) to make it compatible with the 
shuttle orbiter and with the other booster. 
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3.0 SHUTTLE TO SPACE STATION DOCKING OPTIONS 


The Space Station Program Phase B definition studies identified a concern 
as to the best way to effect docking between the shuttle orbiter and the space 
station. The safety aspects of bringing these two large and massive vehicles 
together were a prime consideration in the suggested docking methods. 

Among the systems that have been considered for docking are: 

. The direct docking of -he shuttle orbiter to the space station, 
as in the Apollo Program. 

. The use of manipulators, on either the orbiter or station, to 
effect a more mechanically determinate docking maneuver, and 
at a much lower contact velocity than is practical with direct 
docking. 

. An extendable soft-dock system which provides a large distance 
between the docking vehicles at initial contact, and reduces 
the docking loads through the flexibility of the system. 

. Free-flying and docking the individual space station or other 
modules between orbiter and station, so as to avoid the close 
proximity of orbiter and station. The station and the orbiter 
stationkeep at some distance from each other. 

The purpose of this task was to identify, analyze and recommend resolution 
of the hazards involved in the suggested methods for docking the orbiter to the 
modular space station; and to make recommendations as to the preferred docking 
methods from the safety point of view. 


Three kinds of operations were considered: 

. Assembly of the modular space station 
. Normal resupply docking 
. Emergency docking 

The comparison of the various docking options was divided into two 
essentially uncoupled tradeoffs. One tradeoff was between three docking systems, 
and the other between two docking modes. The three docking systems (Fig. 3-la) are: 

. Direct docking system 
. Extendable tunnel docking system 
. Manipulator docking system 

The two docking modes (Fig. 3-2b) are: 

. Orbiter to station docking mode 
. Free-f lying module docking mode 
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The hazards identified in this task, and the resulting analyses, are 
applicable to any combination of docking vehicles which use the docking systems 
and modes considered here, providing at least one of the vehicles is manned. 

The conclusions and recommendations reached, however, cannot be applied to all 
such vehicle combinations without careful re-evaluation. The reason is that 
the effects and criticality of the hazards may differ according to the con- 
figuration, size, mass, control systems, and other features of the vehicles. 

The further these features vary from the orbiter, space station, and individual 
free-flying modules considered here, the less the confidence that can be placed 
on the applicability of the results and conclusions. 

Further differences which may invalidate the results of this task arise 
when additional hazards exist because of the nature of the vehicles. For 
example, when one of the docking vehicles is a propulsion stage (e.g., a tug) 
or contains large quantities of propellants (e.g., a propellant depot), hazards 
associated with propellant slosh, leaks, etc., must be additionally considered. 
Another example is a reusable nuclear shuttle, which poses nuclear radiation 
hazards. For such vehicles, the conclusions of this task must be re-assessed. 
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3.1 CONCLUSIONS AND RECOMMENDATIONS 

The conclusions reached in the evaluation of the docking systems are as 
follows. 


. Each of the three docking systems — direct docking, extendable 
tunnel and maniDulator--can be made adequately safe. 

. The stationkeeping and the dual manipulator methods of using 
the manipulator docking system have the potential of personnel 
loss in the event of loss of manipulator control before a 
manned attached module is docked. This remains a residual 
hazard even when complex emergency life support requirements 
are added to the manned modules. The dual docking method 
requires more operations to effect docking, but does not have 
the potential for loss of personnel. 

. All three docking systems have the potential of damage to the 
docking system and damage to the vehicles. The damage to the 
spacecraft could, in certain circumstances, be critical enough 
to result in loss of vehicle or loss of personnel. 

, The direct docking system has the greatest potential for in- 
advertent collision because of the close proximity of the 
docking vehicles. 

. The manipulator docking system has the minimum potential for 

inadvertent collision between vehicles because of the relatively 
large separation distance at initial capture, but has more potential 
failure modes which can result in inadvertent contact and damage. 


, The direct docking can perform a time critical emergency docking 
quicker than the other systems. The manipulator docking system 
has more potential for docking with an out-of -control , tumbling 
or spinning spacecaft. 

, The hazards and risks of the three systems are not equally well 
understood because of the different development status of the 
systems. The direct docking system is relatively well understood 
from Gemini and Apollo experience; the manipulator system has 
been defined to some extent in the Shuttle Phase B studies, but 
has not been tested or simulated at the time of this study; and 
the extendable tunnel system is only in a conceptual stage. 

, The safety advantages and disadvantages of the three systems are 
sufficiently balanced and uncertainties in the current system 
definition are such that a ranking of the system from the safety 
point of view cannot be made at present. 

. If the docking systems, when developed, operate as assumed in the 
study, i.e., without any major additional complications in the 
design or additional hazards, then the extendable tunnel system 
appears to require the least attention to make it adequately safe, 
and the manipulator system the most. 
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The conclusions reached on the docking inodes are summarized as follows: 

• The free-flying docking mode has a potential for personnel loss 
when used to transfer personnel between orbiter and station. The 
necessary safety requirements for 6 men on the free-flying module reduce 
the payload capability by 500 kg (1200 lb) and 3 m-* (100 f t^) , 
but the potential for personnel loss remains a residual hazard. 

. The free-flying module docking mode precludes the possibility of 
a single accident resulting in loss of both the orbiter and 
station. 

. No significant safety differences exist between the integral 
systems modules, space-based mini tug, and ground-based mini 
tug methods of using the free-flying module docking mode. 

. The orbiter to station docking mode has more potential of causing 
major damage to the orbiter and/or station than the free-flying 
docking mode, but does not directly lead to personnel loss. Loss of 
personnel or loss of a vehicle as a result of the damage is possible 
but not likely. 

. Use of the free-flying mode for transferring only unmanned modules 
between orbiter and station eliminates the potential of personnel 
loss during transfer. It also has a reduced potential for vehicle 
contact and damage compared to the orbiter to station docking mode 
because of the simpler geometry and smaller docking energy involved. 

. The orbiter to station docking mode provides significantly quicker 
docking than the free-flying mode in the event of a time critical 
docking requirement. 

The recommendations that result from this task are based on the following 
precedence of safety selection critiera: 

. A system or mode which has the lesser potential for personnel 
loss is preferred. 

. Of the remaining choices, the system or mode in which the safety 
requirements can result in a significantly lesser risk (in terms 
of probability and severity of damage) is preferred. 

. Vfoere the requirements result in essentially equal risk, the choice 
in which the requirements and guidelines result in significantly 
less design impact is preferred. 

. The capability to better deal with an emergency situation is 
considered in the recommendations, but is weighted relatively 
lightly because there is no clear-cut advantage to any of the 
systems or modes, and because of the low probability of an 
emergency docking being required. 
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These recommendations are: 

. The direct docking, extendable tunnel, and manipulator docking 
systems should all be considered as acceptable docking systems 
from the safety point of view. 


. The stationkeeping and dual manipulator methods of using the 
manipulator docking system should be rejected as practical 
options for personnel transfer in normal operations because of 
their high potential for personnel loss. The methods are 
acceptable for transfer of unmanned modules or for emergencies. 

. The use of the free-flying docking mode for the transfer of 
manned modules should be rejected for normal operations because 
of the potential for personnel loss. This mode may be used in 
emergencies. 

. The orbiter-to-station docking mode should be considered accept- 
able from the safety point of view with any of the acceptable 
docking systems. 


. If mini tugs (such as remote maneuvering units) or modules with 
self-contained propulsion, control and docking capabilities (such 
as the space tug) are developed for other purposes and a^e avail- 
able, their use in transferring unmanned modules or payloads between 
orbiter and station should be considered as an acceptable decking 
mode. Use of this free-flying module mode for unmanned payloads 
in conjunction with the use of the orbiter to station mode for 
all manned modules has significant safety advantages. 

3.2 RESIDUAL HAZARDS AND HAZARDS RESOLUTION 

This section summarizes the hazards identified and their resolution and 
presents the resulting requirements for supporting research and technology. 

3.2.1 Resolution of identified Hazards 

The 23 hazards identified in this task and their disposition is shown in 
Table 3-1. This shows the judgments of the investigators as to which hazards 
should be resolved by implementation of the recommended requirements and 
guidelines; which are residual hazards; which of the residual hazards represent 
acceptable risks; and which require supporting research and technology (SRT) 
or must at present be considered as unresolved safety issues. 

3.2.2 Supporting Research aod Technology Requirements 

The supporting research and technology requirements resulting from the 
areas of unc *rtainty of this task are listed below. The main originating 
hazards /emei mey are indicated in parenthesis. 
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Table 3-1. Hazards Resolution 


Hazard No. 

Hazard 

2.1.001 

Impairment or visibility at critical 
moment . 

2.1.002 

Loss of vehicle control prior to 
docking contact. 

2.1.003 

Loss of vehicle control after 
initial contact. 

2.1.004 

Failure to inhibit attitude hole of 
one vehicle after capture. 

2.1.005 

Loss of docking system function or 
control. 

2.1.006 

Failure of orbiter payload module 
deployment mechanism. 

2.1.007 

Hardware protrusions in the docking 
tunnel. 

2.1.008 

Unsecured equipment and personnel 
during docking. 

2.1.009 

Degradation of life support system. 

2.1.010 

Docking hatch opened when pressure 
equalization incomplete. 

2.1.011 

Electric discharge during Initial 
contact. 

2.2.001 

Loss of vehicle control in close 
proximity to other vehicle. 

2.2,002 

Loss of attenuation capability. 
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Table 3-1. Hazards Resolution (Cont.) 


Hazard No. 

Hazard 

Resolved 

Residual 

2.3.001 

Loss of vehicle control prior to 
docking contact by extendable 
tunnc 1 . 


X 

2.3.002 

Loss of vehicle control after 
capture by extendable tunnel 
docking system. 


X 

2.3.003 

Loss of pressure in the pneumatic 
extension and energy absorption 
system. 

X 


2.4.001 

Loss of vehicle control prior to 
capture by manipulator. 


X 

2.4.002 

Loss of vehicle control after 
capture by manipulator. 


X 

2.4.003 

Loss of manipulator joint motor 
cuntrol. 


X 

2.4.004 

Loss of manipulator computer 
aided control system. 

X 


2.5.001 

Loss of Communications/Command 
capability during docking by 
unmanned free flying module. 


X 

2.5.002 

Loss of propulsion or control 
capability during docking by 
manned free flying module. 


X 

2.5.003 

Loss of life support capability 
during docking by manned free 
flying module. 


X 
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. The feasibility using a non-collision approach path during the 
docking maneuver until the approach velocity is reduced to within 
the docking attenuation capability should be investigated. Orbital 
mechanics, guidance, propellants penalties, optical aids and human 
factors should be considered, and detailed procedures developed. 

The risks and other factors of this method should be evaluated and 
compared with the direct (collision path) approach, (Fig. 3-12). 

. The dynamics of the docking maneuver under various nominal and 
worst case conditions should be investigated to assure that design 
requirements and operational procedures are available undei all 
credible conditions to ensure the safety of the vehicles. Special 
attention should be given to vehicle conditions with maximum off- 
sets of the docking port from the center of gravity, and to control 
system or propulsion failures immediately before or after contact. 

, Simulation studies of the dynamics and crew capabilities of the 
manipulator decking system snould be conducted at the earliest 
possible time in order to understand the dynamic characteristics 
of the system and to identify and resolve hazards which are not 
apparent from conceptual studies. A safety analyses should be 
an integral part of such simulations. 

3.3 MSELINE MODEL 

The baseline model described in this section illustrates the features of 
the three docking systems, the two docking modes, and the assembly, normal 
resupply docking and emergency docking operations which were considered during 
this task. 

3.3.1 Direct Docking System 

The use of the direct docking system is illustrated in Figure 3-2 ta) for 
the orbiter to station docking. Direct docking may also occur when a free- 
flying module docks either to a station or to an orbiter. It involves the 
approach of the tvro docking vehicles right up to each other so that the integrally 
attached docking mechanisms can make contact for initial capture. The direct 
docking system requires the dissipation of relatively large energy levels be- 
ause of the coarse velocity control expected for propulsive maneuvers of the 
large masses involved. 

3.3.2 Extendable Tunnel Docking System 

The extendable tunnel decking system uses an extension mechanism of some 
kind so as to extend the docking mechanism on one of the two docking vehicles 
some distance from the vehicle before effecting initial contact and capture, 
and is then retracted to draw the two vehicles together for rigidizlng. The 
distinguishing features of the extendable tunnel docking system are that it 
provides a long reparation distance of the two vehicles at the instant of first 
contact, it provides stability after capture and during drawn dow; # and affords 
a long storke, low stiffness attenuation capability. 
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Figure 3-2(a) * Direct Docking System Operations 


One extendable tunnel docking system concept adapted from a concept con- 
sidered for the Apollo, is shown in Figure 3-2 (b). It employs a docking port 
attached to one end of an accordian-like bellows tube, extendable to approxi- 
mately 3 m (10 ft) in length. Tests in two-dimensional simulated docking of 
the Apollo of this system showed that it was feasible and had no major problems. 
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The extendable tunnel system can be used in two different methods. In 
the first method, illustrated in Figure 3-3, the docking system is first fully 
extended, and initial contact and capture are effected by propulsive maneuvering 
of the whole vehicle. In the second method, illustrated in Figure 3-4, the two 
vehicles stationkeep at a relatively close distance before the docking system 
is extended, and initial contact and capture are effected by extending the 
docking system relative to the stationary vehicle. The results of the analyses 
and the conclusions are applicable, however, whichever method is used. 

3.3.3 Manipulator Docking System 

The manipulator docking system uses a manipulator on one of the docking 
vehicles to effect capture of the other one and to bring the two vehicles 
together for docking, latching and rigidizing. The main features which make 
the manipulator docking system different from the other systems are that 
the two docking vehicles stationkeep at some stand-off distance before docking, 
and that the manipulator brings the two vehicles together at a low controlled 
velocity. The energy attenuation requirements are low. 

Three basic methods can be used for manipulatoi docking and are illustrated 
in Figure 3-5. These are respectively: 

. Stationkeeping method 

. Dual dock method 

. Dual manipulator method 

All three methods have be considered in the study task. 

3.3.4 Orbiter to Station Docking Mode 

Two different modes of docking are possible with each of the docking 
systems describer earlier. These are the orbiter to station docking mode and 
the free-flying module mode. 

The orbiter to station docking mode is illustrated in Figure 3-6. The two 
vehicles approach each other to within the distance required by the particular 
docking system used; i.e., within 0.3 to 20 m (1 to 60 ft). This mode results 
in the attachment through the docking port interface of two large masses, namely 
the orbiter and station, which are each of the order of 90,000 kg (200,000 lb) 

3.3.5 Free-Flying Module Docking Mode 

The free-flying module docking mode, illustrated in Figure 3-7, uses a 
f ree -flying module to fly between and dock to the orbiter and station. In 
this way the orbiter and station can stand off from each other in station- 
keeping modes at a relatively large distance, which may in practice be 150 m 
to 1.5 km (500 ft to 1 mi). The free-flying module may be manned or unmanned. 
All dockings occur between an individual module, typically of 9,000 kg (20,000 
lb) mass, and the station or orbiter. Docking impact energies are, therefore, 
only 20 percent or so of those involved in the orbiter to station docking mode 
(at the same velocity). 


50 


SD 72-SA-0094-1 


I 



Space Division 

North American Rockwell 



Figure 3 3. Extendable Tunnel Docking System, Docking Vehicle Active 



Keeping, Doc ting System Active 
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Attitude control, propulsion, guidance and communications capability may 
be achieved in three distinct ways: 

. Integral systems module, i.e., all functions are built into the 
free-flying module 

. Space-based mini tug, i.e., brought up in the orbiter 
. Ground-based mini tug, i.e., normally based on the space station 
3.3.6 Emergency Docking 

Analysis of the docking system included consideration of emergency docking 
to identify hazards and considerations in tradeoff evaluations. 

Identification and evaluation of potential emergencies has shown that, so 
far as docking is concerned, emergency docking is characterized by one of the 
following two situations: 

1. A time critical situation on the orbiter, free-flying module, 
or station, in which a docking is required to save or prevent 
injury to personnel or damage to the vehicles, or otherwise 
prevent a hazardous or dangerous situation from reaching 
catastrophic proportions. 

Examples of time critical situations are fire, fumes, impending 
explosion, leakage, atmospheric depressurization, failure of 
life support, power failure, and injured personnel. 

2. Docking to a vehicle which has lost or experienced degradation 
of a critical docking function. 

Examples are attitude control failure and uncontrolled tumbling. 

Both of these emergency docking operations have been considered in the 
subsequent analyses. 

3.4 HAZARDS IDENTIFICATION 

Potential hazards associated with the docking systems and modes were 
identified by setting out the functions which have to be performed, and then 
considering what hazards may arise in each function from equipment failures, 
operational errors, unexpected environments nnd major malfunctions or accidents. 

3.4.1 Functional Analysis of Docking Systems 

Top-level functions required for docking of two spacecraft are listed in 
Table 3-2. These are general, and are applicable to an., set of vehicl-s, and 
to all the docking systems and docking modes considered. 
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Table 3-2. Top-Level Functions Required for Docking 


Pre-Contact Flight Phase 

1. Acquisition - One vehicle must locate the other either visually 
or electronically. 

2. Gross Orientation - One vehicle must maintain attitude hold, 
while the other translates and rotates into alignment. The 
vehicle maintaining attitude hold will be called the "passive" 
vehicle. 

3. Station Keeping - The active vehicle must station keep with the 
passive vehicle for inspection of the docking port condition. 
Active vehicle attitude hold is required. 

4. Deploy Docking System - The active vehicle must deploy or arm 
the active portion of the docking system. 

5. Fine Orientation - The active vehicle must fine align the active 
docking system with respect to the passive vehicle docking port 
in both translation and rotation. 

6. Final Closure - The active vehicle docking interface must be 
maneuvered to contact the passive vehicle docking port. Lateral 
drift and residual attitude misalignment must be corrected 
during axial closure. 

Contact Phase 

1. Energy Attenuation - The active vehicle docking system must 
absorb the energy of relative motion between the two vehicles. 

Post-Contact Phase 

1. Capture - The active vehicle mating system must provide connection 
to the passive vehicle. 

2. Attitude Alignment - Residual attitude misalignments between the 
vehicles must be corrected either by active vehicle maneuvering 
or by the capture mechanism prior to seating the mating inter- 
faces. If the capture mechanism provides attitude alignment, 
the active vehicle must be placed in the free mode (i.e., no 
attitude hold). The passive vehicle remains in the attitude 
hold mode. Failure to Inhibit attitude hold on one of the 
vehicles will cause both control systems to fight to hold their 
respective misaligned attitudes. 
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Table 3-2. Top-Level Functions Required for Docking (Cont.) 

Post-Contact Phase (Continued) 

3. D raw Down - The docking interfaces must be drawn together to 
remove residua! attenuation stroke and seat the interfaces. 

4. iuia& - The docking intri faces must be structurally connected 

either automatically or man.i.-tlv to provide the required inter- 
vehicular stiffness for combined vehicle maneuvering. This 
function also can seat pressure it i nt^rveh i cu 1 ar press- 

urization is required. 

Undocking Pha^ t 

1. Unr igidi2e - fhe docking interfaces must In s t ructura 1 lv dis- 
connected to provide a flexible coupling for independent vehicle 
maneuvering. This function can also unseat pressure seals and 
be combined with the separation function. 

2. Separate - The docking interfaces must be physically separated. 
Knergy stored in the docking system mav h> used to provide or 
augment separatum forces. 

3. Recycle decking System - The docking interface must be left in a 
condition to dock again. The rigidizing latches shall extend 
thi attenuators to the unstroked position, the capture latches 
shall be unlocked and recycled, and the docking systems stored. 


55 


SD 72-SA-0094-1 



i 




■*"9 


o Attach manipulator to station 

o Attach manipulator to module in cargo 
bay 

o Extend manipulator 



o Dock module to station 

o Release manipulator from module 

o Retract manipulator 

o Dock station to orbiter 

o Release manipulator from station 

o Attach manipulator to module in cargo 
bay 

o Extended manipulator 
o Dock modjle to station 
o Release manipulator from module 
o Attach manipulator to station 
o Undock station from orbiter 

o Extend manipulator 

o Release manipulator from station 

o Retract manipulator 
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Table 3-5. Functional Comparison of Orbiter to Station 
and Free-Flying Module Docking Modes 




MODE 




Free-Fly Module 



Orbiter 

Integral 

Space 

Ground 


Function 

to 

Systems 

Based 

Based 



Station 

Module 

Mini-Tug 

Mini-Tug 



(Direct Dock) | 



0 

Undock from station 



X 


0 

Free-fly to orbiter 



X 


o 

Dock to delivered payload 
module 



X 


0 

Undock delivered payload 
module from orbiter 


X 

X 

X 

0 

Free-fly (or fly) to station 

X 

X 

X 

X 

0 

Dock delivered payload module 
to station 

X 

X 

X 

X 

0 

Undock from delivered payload 
module 

X 


Y 

X 

0 

Free-fly (transpose) to earth 
bound module 

Y 


Y 

Y 

o 

Dock to earthbound module 

Y 


Y 

Y 

0 

Undock earthbound module from 
station 

Y 

Y 

i 

v 

i 

Y 

o 

Free-fly to orbiter 


Y 

Y 

: & y 

c 

Dock to orbiter 


Y 

Y 

mm 

o 

Undock from earthbound module 



Y 

mM 

o 

Free-fly to station 



Y 


o 

Dock to station 



Y 



X - Deliver and dock a nodule. 
Y ■ Undock and return. a nodule 

• 
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Table 3-6. Correlation of Comaon Hazards with Docking Functions 


Hazard 


Docking 

Function 


Pre-contact 
Flight Phase: 

Acquisition 
Gross Orien- 
tation 
Stationkeep. 
Deploy dock, 
sya. 

Fine orient. 
Final Clos. 


Contact Phase: 
Energy At ten. 

Post Contact 
Phase : 
Capture 
Attitude 
Align. 

Draw down 
Rigidizing 

Undocking Phase 
Unrlgidizlng 
Separation 
Recycle Sya. 




scharge 
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3.5 COMPARISON AND EVALl I I ON OF DOCKING SYSTEMS 

Comparisons of the docking systems were made on the following factors: 

. Number of hazards 

. Criticality of hazards 

. Risk, or combination of probability and criticality 

. Operational complexity 

. Design impact of applying the safety requirements and guidelines 

. Residual hazards 

Comparisons on the first three factors is summarized in Figure 3-8. The 
manipulator system has the worst combination of number of hazards, criticalities 
and probabilities of occurrence, with the stationkeeping and dual manipulator 
methods having two nazards with the worst possible combination of criticality 
and probability. 

The next comparison is on the basis of operational complexity. The 
system with the most operations is exposed to the greatest risk. The significant 
operation? were taken to be the free-fly maneuver, the attachment and detachment 
of a manipulator to a module, and the docking and undocking of a module, including 
rigidizing at a docking port. The comparison is shown in Table 3-7. This table 
covers the normal resupply docking, when a new module is being delivered to the 
station and another one is returned to the orbiter for return to earth. 

The three methods for the manipulator docking systems are shown separately, 
since they differ in the number of operations. There is also a possible varia- 
tion, as shown by the asterisked numbers, according to whether the returned 
module can be reached by the orbiter manipulator without repositioning from its 
delivery position, or whether the orbiter must reposition itself by a free-flying 
maneuver to reach the returned module. 

No clear-cut statment can be made that one system requires more operations 
than another. 

In order to compare the docking systems on the basis of design impact of 
applying the safety requirements and guidelines, only those safety requirements 
and guidelines which are specific to one or other of the systems and which have 
a significant impact on the design need be considered. Significant design im- 
pact is considered to mean the addition of mechanisms, motors, actuators, and 
similar levels of hardware, for safety reasons. 

The following have significant design impact: 

Extendable Tunnel 


. Extendable docking systems shall be designed so that the extension 
mechanisms shall retain sufficient rigidity following any single 
failure to prevent uncontrolled vehicle motion or contact. 


C. 
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Figure 3-8. Probability and Criticality of Docking System Hazards 
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Table 3-7. Number of Operations for Different Docking Systems 



Operation 

System 

Free-fly 

Attach/Detach 

Dock/Undock 

Direct Docking 

2 


2 

Extendable Tunnel 

2 

- 

2 

Manipulator 




Station-keeping 

1-2* 

2 

1 

Dual dock 

1-2* 

3 - 4 * 

2-3* 

Dual manipulator 

1-2* 

1 

3-4* 

1 

*The higher number applies when the orbiter must be repositioned 
to reach the module being returned. 

- , . 


Manipulators 

. Arm joints shall be designed to lock on indication of joint 

motor failure. Lock shall incorporate a slip clutch capability 
to prevent structural failures. 

. Two or more manipulators shall be provided in a manipulator 

docking system. Each manipulator shall br capable of performing 
docking by itself, and shall also be capable of continuing any 
docking function in the event of a failure of the other manipulator 
at any stage of the docking. 

. An emergency jettisioning capability shall be provided for 
manipulators, independent of the normal manipulator system. 

This shall be capable of jettisoning the manipulator following 
a failure or accident which does not allow stowage of the 
manipulator and configuring the orbiter for reentry and landing. 

If the manipulator docking system is considered for transferring personnel 
between orbiter and station using the stationkeeping or the dual manipulator 
methods, the following two additional requirements have a major design impact. 

. Modules which are used for personnel transfer by manipulator docking 
shall be provided with EVA pressure suits for all onboard 
personnel, and with EVA exit capability so that the personnel 
can escape to the orbiter or the space station in the event the 
module becomes stranded between vehicles by a manipulator failure. 
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. Modules which are used for personnel transfer by manipulator 
docking shall be provided with EVA pressure suits for all 
onboard personnel, and with EVA exit capabi^ty so that the 
personnel can esc pe to the orbiter or the space station in the 
event the modules becomes strandnd between vehicles by a 
manipulator failure, 

, Modules which are used for personnel transfer by manipulator 
docking shall provide emergency life support for all onboard 
personnel, until they ran escape or be rescued by external 
means in the event the module becomes stranded between vehicles 
by a manipulator failure. 

The last comparison is in terms of residual hazards. The comparison 
shows: 

. Direct dockcing system - 2 residual hazards 

. Extendable funnel system - 3 residual hazards 

. Manipulator docking system - 4 residual hazards 

3.6 COMPARISON AND EVALUATION OF DOCKING MODES 

The orbiter to station and free-flying module modes were compared on the 
following factors: 

. The potential for crew injury or loss 

. The potential for vehicle loss 

. The potential for vehicle damage 

. The cost and payload impact of required safety 

3.6.1 Orbiter to Station Docking Mode 

The hazards identified for the orbiter to station docking mode have the 
potential of causing major damage to the orbiter and/or the station, but do 
not directly lead to personnel injury or loss. The damage would result from 
inadvertent contact of parts of the structure not intended to make contact. 
Because botn vehicles are large and have complex geometries, with many pro- 
truberances, such as cargo bay doors, wings and manipulators on the orbiter, 
and solar panels, antennas and experiments airlocks on the station, almost 
any unprogrammed motion can lead to contact and damage. 

Generally the effects would be limited to damage to the vehicle, and the 
potential for personnel injury or loss should be assessed as a second order 
effect. The proximity of the orbiter and station, either of which can provide 
for the long-term safety of personnel (one by return to earth and the other by 
virtue of its inherent long* duration capability), and the assumed EVA capability 
virtually ensure that personnel who survive the immediate accident can be safe- 
guarded. 

The possibility of loss of one vehicle follrwing a docking accident is 
quite real, however. The orbiter is vulnerable in a number of ways. The cargo 
bay doors must be closed before reentry; damage to the closing mechanism, or to 
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the doors themselves, could result in the ingestion of hot reentry gases, 
leading to thermal degradation of the internal structure. The wings, fuselage 
and tail surfaces are part of the aerodynamic configuration, and damage can 
affect the stability and control of the vehicle in the atmosphere. The crew 
cabin also is near the docking port, and damage to that could preclude return 
to earth. If an assessment of the damage prevents return to earth, a very 
complex and costly rescue and repair shuttle mission would be required, pro- 
bably with much EVA maintenance. In extreme cases the orbiter would be written 
off as a complete loss, aid the rescue mission would concentrate on saving the 
personnel and placing the orbiter on a safe reentry orbit. 

The space station, being modular in nature, is much more tolerant to 
damage. Damage would generally be confined to one module, and this could be 
returned to earth in the orbiter for repair or replacement. This could be 
quite difficult, however, if the affected module were the core module, since 
all other modules are attached to it. In such a case the space station may be 
temporarily abandoned, and a new core module brought up in due course. The 
space station would then be reassembled about this module, and the damaged core 
module returned to earth. Damage to the solar arrays (relatively likely be- 
cause of the large area exposed) could similarly lead to temporary station 
abandonment. 

3.6.2 Free-Flying Module Docking Mode 

The free-flying module docking mode has a very definite potential for 
personnel loss. If loss of the propulsion, control or life support capability 
occurs while the module is free flying between orbiter and station with personnel 
onboard, personnel loss can occur. Escape can only be effected by EVA to the 
orbiter and station. Rescue is possible by the orbiter, but only if the module 
can still be stabilized (for docking) and if adequate life support capability 
remains. The possibility of personnel loss must, therefore, be rated as 
relatively high. In contrast to the orbiter to station docking mode, loss of 
personnel can follow directly as a consequence of a system failure, and does 
not depend on a propagation of unlikely effects. The potential for personnel 
loss appears to be about the same for the integral systems module, space-based 
mini tug or ground-based mini tug. 

The possibility of an inadvertent collision between the free-flying module 
and the orbiter or space station is about as likely as for the orbiter to 
station docking mode. The resultant damage, however, is likely to be much less, 
for two reasons. First, the geometry of a single module docking to orbiter or 
station is much simpler, so that fewer points on the two vehicles will come into 
contact. Secondly, the mass of a free-flying module is only about 10 to 20 
percent of the mass of either orbiter or station, so that the energy involved 
in the collision is relatively small. 

The influence of safety on the design complexity of the free-flying module 
docking mode must be judged to be a major impact. The requirement for a life 
support system on the module is not considered as a safety requirement, as it is 
needed for the normal vehicle function of transporting personnel. The redundancy 
required in this system, the added redundancy in the control, power, propulsion 
and communication systems, the EVA suits and EVA capability, and the emergency 
life support capabilities, however, are directly attributable to safety. 
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These requirements reduce the net payload capability of each 6-man free-flying 
module by 534 kg (1180 lb) and available for cargo by 3 m^ (106 ft^) . 

3.6.3 Free-Flying Module Docking Mode Used For Unmanned Operations Only 

A considerably different safety evaluation of tie free-flying module 
docking mode arises if this mode is used only for transferring unmanned pay- 
loads, and the orbiter to station mode is used when personnel transfer between 
the vehicles is involved. This combined mode could be practical if a mini tug 
has been developed for other purposes and is available for docking unmanned 
payloads, or if some orbiter payloads, such as a space tug, have the propulsion 
and control capability built into them, and require transfer from the orbiter 
to the station and vice versa. 

The advantages compared to the orbiter to station docking mode are those 
of docking a smaller mass to the orbiter or station, and of the simpler geo- 
metry reducing the potential for damage on collision without the disadvantages 
of a relatively high potential of personnel loss. 

This mixed mode, therefore, provides safety advantages over the orbiter to 
station docking mode on its own, and over the free-flying module docking mode 
on its own. These advantages apply so long as the free-flying module is not 
used at all for personnel transfer. 

The disadvantages of this mixed mode are not safety disadvantages, but 
are associated with the program complexity of having two docking modes in the 
program. 

3.7 EMERGENCY DOCKING CONSIDERATIONS 

The reasons for emegency docking, establish certain requirements that will 
determine which of the three docking concepts should be favored from an emer- 
gency docking standpoint. The reasons for emergency docking that appear to 
cover the majority of possibilities are as follows: 

. A time critical malfunction of a system in either manned/ passive 
or manned/active vehicles, that if docked to the other, would 
provide succor or permit mission continuance. 

. Retrieval of a disabled, unmanned, free-flying, module or 
disabled unmanned station for the purpose of salvage or 
deorbit of debris. 

. Time critical transfer of disabled crew which could prevent fatality. 

. Time critical transfer of supplies which would prevent crew 
disability. 

Emergency docking considerations favor the orbiter to station docking 
mode over the free-flying module mode because cf its quicker time response. 
Although the direct docking system is the quickest system, the manipulator 
system has advantages in increased separation between the vehicles and in 
capability to deal with out-of-control vehicles 
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The time critical emergency docking reasons (3 out of 4) favor the docking 
system and mode requiring the shortest, operational timeline for the docking 
maneuver; i.e., the fewest docking operations. This favors the orbiter to 
station docking mode over the free flying module mode, and the direct docking 
system over the extendable tunnel and manipulator docking systems. The free- 
flying module mode, in particular, considerably extends the total time from 
initiation of the docking maneuver to its completion. 

However, the importance of reducing the docking time in evaluating the 
merits of the various docking systems and modes must be kept in perspective. 

The probability that an emergency occurs when the orbiter and station can 
initiate a docking maneuver immediately ±s very remote. If the emergency occurs 
in the space station, the chances are that no orbiter is in space at the time. 

A shuttle rescue mission may typically take ten hours from an alert to rendezvous. 
The difference between one method of docking and another may be 15 minutes (in 
an emergency mode), and this time is unlikely to be critical to the success of 
the rescue. 

When considering the two docking modes, the time advantage is clearly in 
the orbiter to station docking mode. In this case the added time for deploying 
and free flying a module to the distressed vehicle could be up to a few hours, 
particularly if a mini tug is involved, and this could be a significant addition 
to the total time available. 

The two emergency docking situations that involve spacecraft systems 
malfunctions could be too hazardous for an approach with a direct docking 
system. Of the three docking systems considered, only the manipulator has the 
capability to add its dexterity to that of the active vehicle in the task of 
capturing a malfunctioning target vehicle. If the emergency consists of the 
passive vehicle having lost attitude hold capability and it is either tumbling 
very slowly, within the design capability of the docking system, or is subject 
to unpredictable motions due to venting, the direct docking system would be 
the least desirable, because of the close approach of the two vehicles. The 
manipulator system would offer the best and safest method with the extendable 
tunnel an intermediate choice. 

3.8 DOCKING DYNAMICS WITH DOCKING PORTS OFFSET FROM THE CENTER OF MASS 

The current experience of docking on the Gemini and Apollo programs has 
dealt with the situation in which the centerlines of the docking ports were 
essentially aligned with the centers of mass of the two docking vehicles. 

This results in minimum angular motions upon contact. 

The current configurations of the orbiter and the modular space station 
result in docking port alignments which are offset from the respective center 
of mass as shown in Figure 3-9. This leads to an angular motion of the two 
vehicles relative to each other upon initial docking contact, which must be 
cancelled out by the attitude control systems of the vehicles (or by the 
manipulator, where used for the final docking). The direction of the angular 
motions (assuming zero angular rates before contact) will be in the same direction 
for the two vehicles if the docking port lies between the two centers of mass 
(see Figure 3-10A) , or in opposite directions if both centers of mass are on 
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Figure 3-9 . Typical Orbiter to Station Docking Configurations Showing 
Relative Positions of Centers of Mass and Docking Ports. 



Figure 3-10 . Direction of Initial Angular Motions Following Docking. 
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the same side of the center of mass (see Figure 3-10B). The angular velocity 
of each vehicle depends on the contact velocity, the vehicle mass, moments of 
inertia and distance of the center of mass from the docking pore. The velocities 
for the two vehicles will in general be different and if the necessary correc- 
tions are not promptly applied by the attitude control systems, contact with 
the two vehicles with consequent damage will result. The dynamics of the 
situation, and the consequences of a control system failure at the critical 
moment are, therefore, of interest from the safety point of view. 

The angular excursion which will be experienced depends on the initial 
angular velocity and the control authority available from the vehicle attitude 
control system. 

The worst situation occurs when a large orbiter docks to a large station. 
This obviously poses geometric problems, both in the detail design of the dock- 
ing mechanism itself to allow for such angular misalignments, and in the potential 
of inadvertent contact between the vehicles. 

This sensitivity to docking velocity and control moments is shown in 
Figure 3-11. This chart shows that for a docking velocity of 0.3 m/sec (1 ft/ sec) 
the station will turn through a 32-degree angle. The station would require 
72 seconds to arrest this motion. 

Analysis has shown that the orbiter, with control authority about two 
orders of magnitude greater than that of the station, can counteract angular 
motions practically simultaneously, and does not have this kind of problem. 

A serious hazard occurs if the attitude control system fails after capture, 
but before motion has been arrested and the vehicles stabilized. If this 
happens, the attached vehicle will continue its angular motion, the docking 
interface will be broken, and the vehicles will collide with each other. 

The recommended solution is to fly the orbiter so that it follows the 
space station motion. This would involve complex sensing devices or procedures, 
to track the station angular motions, and possible minimum impulse attitude 
adjustments on the orbiter. This maneuvering would continue until the angular 
motions of the two vehicles have been damped out enough to enable rigidizing 
to be performed while the cwo vehicles are still rotating in inertial space. 

If the manipulators are used for docking, then the same problem can arise, 
and the same corrective procedures applied, if the control system failure is in 
the control system of the manipulator. In this case, however, the motion is 
much less than for direct docking because of the dynamics (as shown above), 
the manipulators could possibly provide some damping torques, and the station 
attitude control system provides a back-up to the manipulator control system. 

This problem is, therefore, not very severe where manipulators are used for 
docking. 


70 


SD 72-SA-0094-1 




Space Division 

North American Rockwell 


3.9 NON-COLLISION DOCKING APPROACH VEC10R 

A potential hazard exists when two docking vehicles approach each other 
on a line-of-site course, as usually planned for the final docking maneuver. 

This is essentially a collision course, and if a control system failure occurs 
on the active vehicle, so that the final velocity reductions cannot be achieved, 
a collision will occur at a velocity higher than the capability of the docking 
system with consequent damage. 

In order to avoid this hazard, a new procedure is suggested here, which 
avoids the possibility of an inadvertent collision at too high a velocity. 

This consists of aiming the approach velocity vector not at the docking port 
of the target vehicle, but at an imaginary "pseudo-target” some distance to 
one side of the target vehicle. This is illustrated by Figure 3-12. The 
pseudo target is sufficiently to the side of the target vehicle that if a 
control system failure should occur, the active vehicle passes by the target 
without the possibility of contact. Some margin may be allowed for possible 
rotations and errors. 

This non-collision approach vector is maintained while the velocity of 
the active vehicle is above the docking system attenuation capability. 
Deceleration through the various "braking gates" occurs along this direction. 

The velocity vector is only changed to be on a line-of-site, or collision, 
course when its velocity has been reduced to within the docking system 
attenuation capability. If a control system failure occurs now, the docking 
system can withstand the collision without damage. 

Two potential difficulties can be foreseen with this procedure. First, 
the guidance of the vehicle towards a non-existent pseudo target is a more 
complex maneuver than a simple line-of-sight approach. It may be found, 
however, that a "bias" can be introduced simply and reliably into the optical 
system. The angle of view of the target vehicle will continually change, 
however. 

Secondly, the attitude control system programming is more complex, 
possibly requiring more propellants, and more complex computer aided controls. 

If the orientation of the active vehicle is maintained constant, the braking 
maneuvers require simultaneous firing of several jets in a predetermined but 
constant ration, and this is a non-optimum use of the system. 

T p d safety advantages, of completely avoiding the possibility of an in- 
advertent collision at a velocity to cause damage, must be evaluated against 
the potential disadvantages pointed out. This preliminary evaluation indicates 
that the advantages may be worth the penalties involved. A fuller evaluation 
of the method, including simulations with visual displays, should be made. 
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ORB I TER (ACTIVE VEHICLE) 

Figure 3-12. Non-colllalon Docking Approach. 
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4.0 PERSONNEL TRAFFIC PATTERNS, ESCAPE ROUTES 
AND CN-BCARD SURVIVABILITY 


The purpose of this task was to analyze the personnel traffic patterns, 
escape route, and on-board survivability from a safety standpoint for the 
orbiter with crew and passengers, sortie modules, and for the modular space 
station. Particular situations investigated were normal operations, emer- 
gency operations, IVA and EVA. 

Generalized candidate configurations, typical of the many variations 
possible and those which have been or are being considered, were modeled for 
the orbiter, sortie modules, and modular space station, and evaluated fcr 
their ability to satisfy safety requirements which evolved from an analysis 
of identified credible emergencies. 

4.1 CONCLUSIONS AND RECOMMENDATIONS FOR BASELINE ORBITER CONFIGURATION 

The safety conclusions and recommendations tor the baseline orbiter con- 
figuration defined in Phase B studies (Figure 4-1) involve compartmenta- 
tioiij suit provisions, airlock sizing, EVA ingress /eg ress , and operational 
and suosystems capability. These are: 


CREW 
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o Quick-donning pressure suits which do not require prebreathing 
(8 psi suits) should be provided for all on-board personnel. 

o The crew/passenger compartment should be divided into two sections 
by a partition which can exclude smoke and fumes, and can provide 
protection against excessive heat from a fire. Pressure build-up 
beyond the capability of the partition can be provided by suitable 
pressure relief valves in each section. These sections can provide 
temporary refuge until corrective measures can be taken. 

o All equipment required for return to earth should be capable of 
operating in a depressurized environment, and of being operated 
by the crew in pressure suits. 

o Capability should be provided for returning from EVA directly 
into the crew/passenger compartment . 

o Provided the above recommendations are implemented, the airlock 
is not required for safety purposes. It should be available, 
possibly as a payload item, on missions for which EVA is planned. 

o If the airlock is capable of accommodating all passengers in 

emergency shirtsleeve conditions through deorbit and entry, then 
8 psi suits are required only for the orbiter crew on those 
missions. The passengers have time to return to their seats for 
landing after reaching low altitudes. 

4.2 CONCLUSIONS AND RECOMMENDATIONS FOR ALTERNATE ORBITER CONFIGURATIONS 

4.2.1 Configuration with Large Airlock 

The airlock requirements for performing EVA are that the airlock be 
sized to accommodate two men in pressure suits with portable life support 
systems (PLSS) . Such an airlock is likely to be large enough to accommodate 
four and possibly six men in shirtsleeves. 

The airlock for the baseline orbiter which resulted from the Phase B 
study is even larger than this requirement. It is a sphere of 2.4 m (8 ft) 
diameter, intercepted by the flat hatches. As shown in Figure 4-2, this 
airlock can accommodate at least eight men in hammock-type supports under 
emergency shirtsleeve conditions. Enough room is available for four more 
men, if desired, making a total of 12 men in the airlock. 

Such a large airlock can be used as a second compartment in the event of 
an emergency. In addition to being sized for two crewmen with PLSS, it must 
be capable, in an emergency, of supporting all passengers in a shirtsleeve 
environment through deorbit and reentry. This may require in excess of six 
hours life support capability in the airlock for return to CONUS (Continental 
U.S.A.) landing sites. The capability to land with the passengers in the air- 
lock is not required because the passengers can return to the crew/passenger 
compartment to their respective (or makeshift) landing positions after the 
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Figure 4^2 Emergency Accommodations in Baseline Orbiter 
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orbiter re-enters the sensible atmosphere and the cabin is repressurized to 
a habitable environment. Passenger egress from the airlock could occur at 
approximately 4500 m (15,000 ft) altitude, 4 minutes prior to landing. 

Specially sized inward bleed valves on the crew/passenger compartment are 
required to ensure an adequate repressurization rate. 

Two pressure suits only are required in this case for use by the crewmen. 

These must be quick-donning 8 psi suits, which do not require any pre-breathing. 

The airlock cannot be used for getting into the suits, as the airlock hatch 
cannot be opened when shirtsleeve passengers are inside it and the atmosphere 
in the orbiter has been lost or contaminated. The two suits should therefore 
be kept in the crew/passenger compartment, not the airlock. 

It is estimated that the time required to don 8 psi suits is 7 minutes, or 
equivalent to the time available in a shirtsleeve environment to cope with 
pressure loss through a one-inch-diameter hole. Additional reaction time can 
be gained by employing flood flow control, which replaces the atmosphere at 
approximately the same rate at which it is being lost, to maintain the atmos- 
phere at the minimum acceptable pressure level. 

For missions in which EVA is planned as part of the normal mission, 
pressure suits must be carried for all the passengers, as well as for the 
two crewmen and the EVA men. These are required in case an airlock malfunc- 
tion does not allow repressurization of the airlock (e.g., the external hatch 
cannot be sealed). The crew and passengers then don their suits, the crew/ 
passenger compartment is then depressurized, and the EVA men can enter. These 
additional suits may be much simpler than EVA or IVA suits, as no activities 
are to be performed in them. If the EVA men plan to red-line their oxygen 
supply to maintain a few hours reserves by the time they return, these addi- 
tional suits can be 3.5 psi suits which require perhaps two hours of pre- 
breathing before reducing to the operating pressures. Otherwise, they should f 1 

be 8 psi suits . J; 

n 

4.2.2 Alternative Orbiter Configuration * 

An alternative safety approach for the orbiter is shewn in Figure 4-3. 

This configuration is similar to the baseline with the exception that the 
forward located airlock is eliminated with its volume being absorbed into a 
single habitable compartment; and special design requirements are imposed to 
use the floor of the crew compartment to deal with a fire or atmospheric 
contamination. 

The equipment required for return to earth must be capable of operating 
and being operated in a depressurized condition, as for the baseline config- 
uration. 

Pressure suits (8 psi) must be carried for all on-board personnel for 
all missions. 

A portable airlock can be located in the cargo bay for those missions 
in which EVA is a planned activity. Since suits are provided for all, 
however, emergency EVA can still be performed from the crew/passenger com- 
partment. 
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Figure 4-3. Alternative Safety Approach for Orbiter 
4.2,3 Ideal Orbiter Configuration 

An ideal safety configuration is one in which safety is inherent in the 
configuration, not through subsystems or time-consuming complicated proced- 
ures which may integrally involve personnel. The foremost objectives of such 
a configuration are (1) to desensitize the vehicle from the potential effects 
of credible emergencies, (2) to desensitize the vehicle from arbitrary cri- 
teria, such as vent valve sizing, factored into subsystems design resulting 
from a theoretical analysis of the credible erergencies, (3) to minimize the 
time required to safeguard personnel, and (4) to maximize the time available 
to perform corrective action. 

One configuration which ideally satisfies these objectives relative to 
the credible emergencies and effects considered in this task, is shown in 
Figure 4-4. The configuration consists of a crew compartment, a passenger 
compartment, a two-man airlock, a docking port, three internal hatches, and 
three external hatches, one of which is a docking port hatch. Two 3.5 psi 
suits are provided for the two crewmen. Requirements include capability for 
abort with the passengers in the crew compartment, capability for abort equip- 
ment to operate in a vacuum, and capability for abort controls to be operatable 
by men in pressure suits. 
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Figure 4-4. Ideal Orbiter Safety Configuration 


4.3 CONCLUSIONS AND RECOMMENDATIONS FOR MANNED SORTIE MODULES 

Conclusions reached from the analysis for manned sortie modules are: 

o A sortie module consisting of two separate pressurized modules 
does not have any significant safety advantages compared to a 
single module version. In both cases the orbiter is available 
as a separate refuge compartment. 

o No safety requirement exists for an airlock between a sortie 
module and an orbiter, provided it is acceptable to abort a 
particular mission if a depressurization or contamination 
problem arises in the sortie module. An airlock between 
orbiter and sortie module could be useful in providing IVA 
maintenance capability in such an event, but also poses the 
additional risk of isolating personnel in either vehicle if 
a similar problem arises in the airlock. 

Rficonmendations made are as follows: 

o The airlock, if provided, should be configured such that 
isolation of the sortie module crew from the orbiter does 
not result during the performance of EVA from the airlock. 

If this is not practical, then the emergency capability to 
deorbit all personnel in the sortie module or in the orbiter 
should be provided, or the capability should be provided to 
transfer personnel in the sortie module to the orbiter via 
EVA to enable an abort of the mission. 

o A means of emergency exit (dual egress capability) should be 
provided in sortie modules, for example, by longitudinal 
floor providing independent personnel routes above and below 
the floor. 

o Emergency accommodations should be provided in the orbiter 
for all passengers through an abort. 
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o A means should be provided to release the sortie module from 
the orbiter. Release is differentiated from ejection in that 
no identified credible emergencies require a reaction time 
less than a few minutes, as implied by ejection. 

4.4 CONCLUSIONS AND RECOMMENDATIONS FOR MODULAR SPACE STATION 

Conclusions reached for the modular space station are: 

o A two-pressure volume configuration, such as provided in the NR 
design, provides maximum operational flexibility (e.g., mission 
continuation) in the event of an accident in any one module. 
Adequate safety can, however, be provided without a two-volume 
arrangement, but loss of any one module (temporary or permanent) 
interrupts the mission and may need complex orbiter rescue oper- 
ations . 

o A ’’closed" configuration which provides at least two independent 
personnel routes from any one module to any other, provides 
safety with shirtsleeve operations only. The NR space station 
design provides such a "closed" configuration by providing auxil- 
iary passages between modules in addition to the main passageway 
through the core module. 

o "Open" configurations, such as the MDAC design, rely on airlocks 
and IVA, EVA or orbiter rescue to ensure personnel safety in 
situations requiring emergency evacuation of a module. 

o Special precautions must be taken during space station assembly 
to assure safety of personnel. These precautions include 
restricting access to station compartments which do not have 
dual shirtsleeve egress, unlesss the time spent in the compart- 
ment is short; potentially hazardous equipment has been checked 
prior to entry; EVA suits are provided; .and a buddy system is 
employed. 

o Space station resupply does not present any unusual safety 
, problems which require unique criteria, requirements, or solu- 
tions . 

The following recommendations are made: 

o Interconnect all modules through an auxiliary passage to provide 
dual shirtsleeve egress, or where this is impractical, provide a 
floor in the module which provides for independent personnel 
routes above and below the floor. 

o Design all hatches to be operable from either side to enable 
escape from within or rescue from outside a module/compartment. 

o Interior hatches shall normally be open, with the exception of 
emergency egress hatches which shall normally be closed. 
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o Potentially hazardous equipment should not be located in or near 
areas where maximum crew congestion is likely to occur; e.g., 
dining/recreation areas. 

o Potentially hazardous equipment should not be located in the 
vicinity of the module docking interface. 

4.5 IDENTIFICATION OF CREDIBLE EMERGENCIES 

The assessment of escape routes and compartmentation isolation required 
the identification of credible emergencies from which configuration oriented 
and supporting requirements could be generated through subsequent hazards 
analysis . 

Eleven credible emergencies were identified and used in the analysis. 
These are shown in Table 4-1, including their applicability to the vehicles. 


Table 4-1. Credible Emergencies 


Credible Emergency 

Applicability 

Orb iter 

Sortie 

Module 

Operational 

Station 

Station in 
Assembly 

Fire/toxic environment 

X 

X 

X 

X 

Explosion 

X 

X 

X 

X 

Emergency evacuation 

X 

X 

X 

X 

Loss of pressure 

X 

X 

X 

n 

Failure to open internal hatch between 

X 

X 

X 

wm 

pressure lsolatable volumes 





Failure to open docking hatch after docking 

X 

X 

X 

X 

Failure to close docking hatch before 

X 

X 

X 

X 

undocking 





Inability to use docking hatch for EVA when 

X 


X 


EVA required 





Failure to close external airlock hatch when 

X 

X 

X 


returning from EVA 





Failure to open internal airlock hatch when 

X 

X 

X 


returning from EVA 





Failure to close IVA airlock hatch on 



X 


depressurized/contaminated side or to 





open hatch on pressurized/habitable side 





when returning from EVA. 
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j The effects assumed for four of these emergencies, namely, fire/toxic 

j environment, explosion, emergency evacuation, and loss of pressurization, are 

! listed in Table 4-2. This defines the level of these emergencies considered 

for analysis. For example, the type of fire or toxic environment considered 
requires rapid (0.5 min) evacuation, but does not result in personnel injury, 
and allows eventual return to the affected compartment. More severe accidents, 
which may injure personnel, or which do not allow shirtsleeve return to the 
affected compartment, are considered under "explosion" and "emergency 
evacuation" . 


Table 4-2. Assumed Effects for Variable Level 
Credible Emergencies 



Minimum 
Reaction 
Time (Mins) 

Need to 

Evacuate 

Compartment 

Injured/ 

Incapacitated 

Personnel 

Restoration 
to Shirtsleeve 
Environment 

Can Cause Other 
Listed Credible 
Emergencies 

Fire/Toxic Environme - ": 

0.5 

Yes 

No 

Yes 

Yes 

Explosion 

0 

Yes 

Yes 

No 

Yes 

Emergency Evacuation 

5 

Yes 

No 

No 

No 

Loss of Pressurization 

2-8 

Yes 

No 

No 

No 


4.6 SAFETY ANALYSIS OF ORBITER CONFIGURATIONS 

Seven possible orbiter configurations were evaluated for their inherent 
capability to cope with the credible emergencies identified. The following 
major assumptions were required to scope the analysis to within workable 
bounds. These are: 

o Emergencies, other than hatch failures, are not considered on 
airlocks. 


o Deorbit/retum to earth requires crew participation in crew 
compartment. 

o Rescue vehicle is not available, 
o No double emergencies are considered. 

o Airlocks are sized for two crewmen or all crewmen. If sized for 
all crewmen, they are treated and evaluated as a second volume. 
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o Passage of many personnel through an airlock, two at a time, 
is not acceptable. 

o Airlock compartment for EVA can be crew compartment, passenger 
compartment, or airlock. 

o Planned EVA will be accomplished through an airlock, 
o Safety is not achieved via EVA. 

Each of the seven candidate orbiter configurations was evaluated, within 
the constraints of the assumptions, to determine the operational options avail- 
able to cope with each credible emergency. Analysis of the operational options 
resulted in secondary configurational, subsystems, and operational requirements 
necessary to make the option viable. 

4.6.] Candidate Orbiter Configurations 

The baseline configuration of the orbiter is composed of an airlock, and 
a crew and passenger compartment as shown in Figure 4-1. This is the final 
configuration resulting from the NR Phase B study. 

The seven configurations analyzed are shown schematically in Figure 4-5. 
These are based on the number of practical ways in which the following compart- 
ments can be arranged: 

o Crew compartment 
o Passenger compartment 
o Airlock 



CANDIDATE CONFIGURATIONS 


r c;p J 

>•[ 




1 ‘1 


»• m c p 


7. c 


[C/Tl CREW/PASSENGER COMPARTMENT 
rc~l CREW COMPARTMENT 

m PASSENGER COMPARTMENT 
£2 AIRLOCK 

Figure 4- 5. Candidate Orbiter Configurations 
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A hatch, door, or opening may be located anywhere there is a 9 olid line. 
Compartments which are not habitable, such as the cargo bay, are not included. 

4.6.2 Operational Options 

The operational options available for four of the emergency situations 
are shown, together with their applicability to the specific orbiter con- 
figurations, in Figures 4-6 through 4-9. The single option, which is univer- 
sally available for all emergencies is to "take the risk". A program 
decision not to accept the safety recommendations implies that the risk 
associated with the emergency is being taken. 

4.6.3 Major Safety Requirements 

The multitude of options available to cope with each emergency lead to 
dirferent sets of requirements for each compatible orbiter configuration. 

These requirements are identified, correlated to the originating emergency, 
and grouped in accordance with their applicability to each orbiter configura- 
tion. A logical reduction of the grouped requirements is made to arrive at 
a recommended minimum acceptable set for the configuration. This process 
is illustrated and documented in Figures 4-10 through 4-14. 

Hatch requirements are an important consideration but are not major con- 
figuration drivers and, therefore, all hatch requirements relative to the 
parameters of location, dual opening (hatch within a hatch) or dual closing 
(back-to-back) are consolidated under the column titled "Hatch Requirements". 

These charts contain sufficient information to ascertain the impact on 
vehicle configuration of the elimination of one or more requirement options. 
If, for example, 8 psi suits were eliminated as a viable requirement option on 
the two compartment with airlock orbiter configurations due to a programmatic 
decision, the remaining viable alternatives could readily be determined, as 
shown by Figure £-14, 

A summary of the recommended requirements for all seven candidate orbiter 
configurations is shown in Figure 4-15. Only one configuration, the two- 
compartment with an airlock in between, is identified as not acceptable, 
because a problem in the airlock can isolate the passengers from the crew 
compartment . 

4.6.4 Evaluation of Configurations 

Five basic options were identified for comparing the configurations to 
arrive at relative safety ratings. These relate to the number and type of 
suits; whether IVA or EVA is required to effect transfer of personnel from 
the affected compartment to the crew compartment in the event of an 
emergency; and whether a refuge compartment is available. These five options 
are : 


85 


SD 72-SA-0094-1 




Space Division 

North American Rockwell 


TO PRESSURE ISOLATABLE 
COMPARTMENT 


EXTINGUISH FIRE A 
PURGE ATMOSPHERE 


COMPATIBLE 

CONFIGURATIONS 
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nicifp] [Tip 
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X X X X X 


TO PI RE ISOUTABLE 
COMPARTMENT* 


EXTINGUISH PIRE 6 
' PURGE ATMOSPHERE J 


X X X X X X X 


* ISOLATES ATMOSPHERE, BUT NO SIGNIFICANT Ap CAPABILITY 

Figure 4-6. Options - Fire/Toxic Environment 
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Figure 4-7. Options - Explosion and Emergency Evacuation 
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COMPATIBLE 

CONFIGURATIONS 
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Figure $- 8 . Options - Loss of Pressure 
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Figure 4-9. Options - Failure to Close External Airlock Hatch When 
Returning From EVA (Resulting in Inability to Return From EVA) 
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Emergency/ 
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Figure 4-10. Major Safety Requirements, Crew/Passenger Compartment Only 
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Figure 4-11. Major Safety Retirements » Crew/Passenger Compartment 
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Option 

Pressure 

Quantity 

Suits 

Type 


Transfer Mode 
to Crew 
Compartment 

Refuge Compartment 
Available 

A 

All 

8 

psi 

N/A 

No 

B 

2 

8 

n 

N/A 

Yes 

C 

All 

3.5 

n 

IVA 

Yes 

D 

2 

3.5 

m 

IVA 

Yes 

E 

2 

3.5 

it 

EVA 

Yes 


A comparison of the configurations, using these options, as primary parameters, 
is shown in Figure 4-16* An additional parameter, that of reaction time, is 
introduced to signify the amount of time available to react to the credible 
emergencies. Seven minutes corresponds to the time required for obtaining 
access to and donning 8 psi suits. Two minutes is the time required for per- 
sonnel to evacuate, in a shirtsleeve environment, an affected compartment and 
seek refuge in the adjoining compartment. 

The safety ratings as listed are based on the reaction time and availability 
of a rescue compartment. Options which result in minimum reaction time and ex- 
hibit a rescue compartment are most favorable. The acceptable, good, and best 
ratings apply to the combination of a particular configuration and the number and 
type of pressure suits carried on-board. The ratings are based on the resulting 
capabilities of the configuration/suit combinations, as follows: 


Safety Factor 


Reaction Time 


Refuge Compartment Safety Rating 


7 

7 

2 


minutes 

No 
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minutes 
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minutes 
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2 
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B 
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Figure 4-16. Comparison of Configurations 
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4.7 SAFETY ANALYSIS OF SORTIE MODULE CONFIGURATIONS 

Evaluation of the sortie module configurations is involved with the 
effects of the sortie module configuration on orbiter personnel and vehicle 
safety and, conversely, with the use of the orbiter as a refuge volume for 
sortie module personnel. This task consideres only manned sortie modules 
attached to the orbiter. 


4.7.1 Candidate Sortie Module Configurations 

The six candidate sortie module configurations shown in Figure 4-17 were 
selected for evaluation. 



□ PRES I SOL VOL FOR ALL 
TWO-MAN AIRLOCK 


Figure 4-17. Candidate Sortie Module Configurations 
4.7.2 Operational Options 

The operational options available to cope with three credible emergencies 
are shown for each of the candidate sortie module configurations in Figures 
4_18 through 4-20. Again, as for the orbiter analysis, an option which is 
universally available for all emergencies is to "take the risk". A program 
decision not to accept the safety recommendations implies that the risk 
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associated with the emergency is being taken. A second option which is 
universally available for all sortie module emergencies is to use the orbiter 
for refuge. 


COMPATIBLK 

CONFIGURATIONS 




X X 7 


X 


X X X X X 


X 


X X X X X 


*Isolata»5 ataosphera, but no significant delta-? capability 


Figure 4-18 Options - Fir« /Toxic Environment 
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Figure 4-19 Options-Explosion 
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4.7.3 Major Safrty Requirements 


The operational options 
at major safety requirements 
The recommended requirements 


of the previous section were evaluated to arrive 
for each candidate sortie module configuration, 
are summarized in Figure 4-21, 
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Figure 4-21.. Summary of Recommended Requirements 
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Only four requirements are involved in the recommendation. These are 
personnel shirtsleeve refuge/abort in the orbiter, personnel shirtsleeve 
refuge/abort in the sortie module, EVA to and from the orbiter, and hatch 
requirements. Of these requirements, only one, the requirement for personnel 
shirtsleeve rescue/abort in the sortie module is not common to all configura- 
tions . 


The only requirement which is common to all candidate configurations and 
recommended sets of requirements is that of personnel shirtsleeve refuge/abort 
in the orbiter. The underlying rationale for recommending this requirement is 
that regardless of the sortie module configuration, exit to and refuge in the 
orbiter is the natural goal for emergencies which do not cut off the normal 
egress patn to the orbiter. 


4.7.4 Emergency Egress to Orbiter from Sortie Module 


Three basic configuration concepts, shown in Figure 4-22 are available 
for providing emergency egress to the orbiter for an emergency, such as a fire 
or explosion, which has blocked the normal egress route. 



Figure 4-22. Emergency Egress From Sortie Module 


t 


i The second concept is recommended as being the most practical one. This 

* is similar to that employed on the NR modular space station modules and uses 

|; an internal floor to divide the module horizontally into two basic volumes. 

‘ Access doors (cr openings) are provided in the floor at each end of the module 

\ with sufficient clearance underneath the floor to allow shirtsleeve personnel 

> to maneuver to the exit at the orbiter interface and egress. 
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4,8 SAFETY ANALYSIS OF MODULAR SPACE STATION CONFIGURATIONS 

The NR and MDAC modular space station configurations resulting from 
Phase B studies were evaluated for the inherent means available to cope with 
the identified credible emergencies. Normal operations of the space station 
in between resupply operations, the space station assembly, and the resupply 
operations were considered. 

The analysis assumes that each of the credible emergencies can occur in 
any of the modular elements and that each modular element and the orb iter, 
when attached to the station, is a pressure isolateabie volume compartment. 

The credible emergencies considered lead to a number of basic criteria, which 
are described below. 

4.8.1 Dual Egress 

Certain emergencies in a module, such as fire or explosion, nay cut off 
the normal escape route to a survivable area resulting in entrapment of the 
crew within the affected module. Tne possibility of isolating personnel in a 
compartment in which an emergency has occurred can be reduced if multiple egr ss 
paths to a survivable area are provided within a habitable compartment. The 
desirability of these provisions, from the safety point of view, lead to the 
dual egress criterion which is stated as: 

o Normally habitable compartments of more than 25 m3 (880 ft^) 
in volume shall have two or more exits into areas which pro- 
vide for personnel survival. 

The volume below which the dual egress criterion does not apply, 25 
(880 ft^), is determined by judgment and is intended to represent the minimum 
compartment volume below which the immediately dangerous space (heat, flames, 
debri,) in a credible emergency would prevent crew escape and survival, regard- 
less of the number of egress routes. 

Four conceptual means of satisfying the dual egress criterion for the 
modular space station are available: 

A. Dual shirtsleeve entry/egress inherent in the configuration 
through the interconnection of modular elelements, in a closed 

ring 71 configuracion. 

B. External connecting passages, called auxiliary passages, 
required between proximate modules to provide the second 
shirtsleeve egress path. 

C. Module floors which provide escape routes above and below 
the floor. 

D. Airlocks with docking capability for rescue by the orbiter, 
or with sufficient suits for F.va escape/rescue, are required. 

These concept- aic schematically in Figure 4-23. 
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C. FLOOR IN MODULE D * AIRLOCKS ON MODULES 


Figure 4-23. Alternate Solutions for Satisfying Dual Egress Criterion 
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Both the NR and MDAC stations can meet the dual egress criterion by one 
or more of the above means as can be seen from Figure 4-24. 

4,8.2 Dual Ingress 

Emergencies may occur which may result not only in incapacitating person- 
nel but also in cutting off the rescue path or opening. Because personnel may 
be injured or incapacitated, the time involved to effect rescue may be a 
critical factor for crew survival, and participation of the injured personnel 
in the rescue operations cannot be assumed. Consideration of these possible 
effects of credible emergencies leads to the dual ingress criterion: 

o Access to two or more shirtsleeve entraces into normally 
habitable compartments or more than 25 (880 ft^) in 

volume shall be immediately available from each of the 
other normally inhabited compartments. 

Rationale for the volume constraint on applicability of the criterion is iden- 
tical to that previously discussed for dual egress. 

The primary difference between the dual egiess and dual ingress criteria 
is that dual egress can be satisfied by IVA or EVA, while dual ingress can 
only be satisfied because of time criticality, by shirtsleeve operations. 

The ing . paths available for both subject stations are shown in Figure 
4-25. As shown, an incapacitated crewman in a life support or control module 
docked to the core on the NR station can be reached in a shirtsleeve environ- 
ment either by the dock'ng port or auxiliary passage openings. On the MDAC 
station, an incapacitated crewman in either end of the crew/operations module, 
or in a modulo docked to the crew/operations module, can be reached via only 
one shirtsleeve path and as such does not satis the & ' ingress criterion. 

4 . 8 . i Loss of a Module /Compartment 

An emergency in a module /compartment can render life support and station 
control facilities in the module/ compartment totally inoperable and unrepair- 
able or, in a less extreme case, temporarily inoperable until repairs can be 
effected. 

This situation leads to a mod ule/ compartmen t safety criterion as follows: 

o Capability shall be provided for the emergency shirtsleeve 
survival of all on-board personnel until the next resupply 
or emergency shuttle flight following the loss of access to 
any one mo dule/ compartmen t and the loss of equipment and 
supplies in that mo dule /comp artmen t . If the loss of the 
module/ compartment d'vides the station into two or more iso- 
lated habitable sections, then each section shall provide 
the survival capability for all on-board personnel, including 
an available docking port. 
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This survival volume can be composed of a pressure isolatable compartment 
i within a module, a whole module, or a cluster of modules. 

The loss of a module/ compartment criterion is satisfied by the NR station 
as can be seen from Figure 4-26. The NR station is divided into two separate 
pressure isolatable volumes by the airlock (AL) on the core module. 

On the MDAC station, the separate volumes of the crew/operations module 
and the general-purpose laboratory serve as survival volumes for one another. 
Access between these two modules, should one become depressurized, would be 
through an IVA airlock formed by the hatches of each module at their docking 
interface. 

The modular arrangement does not, however, satisfy via a shirtsleeve 
environment, the part of the loss of a module/ compartment criterion which 
deals with division of the station into two or more isolated volumes. A 
potential hazard with this modular arrangement is that loss of the crew/oper- 
ations module could isolate the crew in separate modules if, for example, 
personnel were working in the power/subsystems module, cargo module, or a 
module or cluster of modules docked to the end of the crew /operations module. 
The only modes available to remite the crew would be for stranded members to 
perform IVA through the crew/operations module using the hatch-formed airlocks 
or to perform EVA to gain access to the genera-purpose laboratory through its 
end-located internal airlock. Either return mode is disadvantageous in that 
it requires storage and dispersement of IVA/EVA suits and critical equipment 
and supplies throughout the vehicle. 
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5.0 ANALYSIS QV DISABLED SPACECRAFT IN A TUMBLING MODE 


Uncontrolled tumbling of a spacecraft following loss of its capability to 
control its attitude is one of the most critical emergency situations that 
could arise in space. For a vehicle with reentry capability, such as a shuttle 
orbiter, neither deorbit nor reentry would be possible under these conditions. 

A rescuing vehicle may be unable to help the tumbling vehicle because it can- 
not dock to it. Such a situation could, therefore, be catastrophic, and 
result in loss of both the vehicle and its occupants. If the tumbling vehicle 
contained a sizeable source of radioactive material, e.g. in a nuclear reactor, 
an unacceptable risk to the population at large may exi°t from the eventual 
random re-entry of the vehicle into the earth’s atmosphere. 

The purpose of this task was to examine possible methods for arresting 
the motion of an out-of-control tumbling space iraft by means external to the 
vehicle in order to save the onboard personnel and, if possible, the spacecraft; 
and to determine the feasibility and establish requirements for personnel 
escape in the event the tumbling cannot be arrested. The tumbling spacecraft 
considered includes the shuttle orbiter, the space station, and individual 
modules, called Small Space Vehicles (SSV’s) for this study. Sortie modules or 
space station modules are typical of SSV’s in size, mass properties and geo- 
metry. The tumbling vehicle was essentially considered disabled and non- 
cooperative, so that use of onboard subsystems or personnel to assist in 
arresting the tumbling was not considered. 


The rescuing vehicle was considered to be a shuttle orbiter with an 
appropriate payload. All the concepts considered for arresting the tumbling 
could, however, equally well be used in a remotely controlled mode from an 
unmanned tug brought up in a shuttle orbiter. This may be applicable in cases 
where the tumbling vehicle presents an unacceptable hazard to the orbiter (e.g., 
if breakup of the tumbling vehicle is possible, or a high radiation environ- 
ment is present), or for orbits beyond the orbiter capability. For the case 
where the onboard personnel have to abandon the tumbling vehicle, however, a 
shuttle orbite : or other rescue vehicle with life support capability was assumed 
to be in the immediate vicinity of the tumbling spacecraft. Also the men were 
assumed to be in communication with the rescuing vehicle, to each have a pres- 
sure suit with portable life support, and an operable hatch which they can 
open to space for extravehicular activity (EVA) transfer to the rescuing 
vehicle. 
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5.1 CONCLUSIONS AND RECOMMENDATIONS 

5.1.1 Arresting the Motion of a Tumbling Spacecraft 

Two preferred concepts for arresting the motion of tumbling spacecraft 
are shown in Figure 5-1. These are: 

. The water stream concept, in which a jet of water is directed at 
the tumbling spacecraft 

. The stick-on rocket concept in which small solid rockets are 
directed at the tumbling spacecraft and fire upon contact 

General conclusions reached are; 

, Feasible, low development cost, operationally practical 

concepts for arresting the motion of out-of-control tumbling 
vehicles have been identified. 

. The preferred concepts can be operated with an adequate margin 
for the worst cases of tumbling orbiter, modular space station, 
and small manned space vehicles considered using only one 
emergency shuttle orbiter launch with the de-tumbling device 
as a payload. 

. T he preferred concepts are adaptable for remote use on unmanned 
-ugs, to reach and arrest the motion of smaller satellites and 
spacecraft in orbits which cannot be reached by the shuttle 
orbiter alone. 

The water stream concept (Figure 5-1A) appears to be the most 
attractive of the concepts identified. It can be developed from 
off-the-shelf, non-spacecraft hardware; have large factors of safety 
and margins to minimize the necessity for extensive qualification, 
since weight is not critical; it car be stored at the launch site or 
sites of the shuttle for long periods without any upkeep costs, and 
be made ready for use in a matter of hours; it can deal with any con- 
figuration and size of spacecraft; it poses no safety problems to the 
shuttle or the tumbling vehicle; it should cause no damage to the 
tumbling spacecraft except possibly to delicate appendages such as 
solar panels; it has only minor development risks; and its operation 
and use is simple, tolerant of errors, and probably requires little 
training, 

• The stick-on rocket concept (Figure 5-IB) also appears attractive. It 
can use existing solid rocket motors to minimize development 
costs; it is a light enough system that a single shuttle flight 
can ensure a large "over-kill" ratio; a long, low maintenance 
storage life is practical at each shuttle launch site; it can 
be ready for launch within hours; like the water stream, it can 
deal with any configuration and size of spacecraft; and its 
operation and use is simple, tolerant of error and probably 
requires little training. 
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Figure 5-1A. Water Stream Concept Used to Arrest a Tumbling 
Space Station 
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Figure 5-1B Stick-On Rocket Concept used to Arrest a Tumbling Space Station 
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. Compared to the water stream concept, the stick-on rocket concept 
has a number of disadvantages. Because it contains propellants, 
it poses a hazard during storage, to the shuttle orbiter, and to 
the tumbling vehicle; it requires the development of some attach 
mechanism; and this mechanism could result in damage to the tumbling 
spacecraft. 

The following recommendations are made, based on the objective of the 
task and on the above conclusions: 

. Analysis and design studies of both the water stream and the 
stick-on rocket concepts should be continued, with the objective 
of confirming feasibility for both manned and unmanned tumbling 
spacecraft. 

. If these studies confirm the feasibility and a reasonably low 
development cost, the more attractive of the two concepts should 
be developed and produced in & time frame to support the space 
shuttle program, and the devices held ready for potential use 
at the shuttle launch site(s). 

. Effort on the other concepts should be discontinued at present, 
but be reviewed if the recommended concepts appear unattractive 
on further study. 

5.1.2 Escape From a Tumbling Vehicle 

The conclusions reached on personnel escape from a tumbling spacecraft are: 

. Simple procedures are available for pressure-suited crewmen to 
abandon the four representative spacecraft examined in simple 
planar motion without interference or recontact with the structure. 

This may require pushing off by the crewmen with an impulse well 
within their capability. This conclusion is generally applicable 
within the range of tumbling rates considered. 

. Multi-axis tumbling of the spacecraft should still allow ample 
margins for avoiding interference or recontact with the tumbling 
spacecraft. 

. No appreciable reduction in crew performance is expected due to 

the tumbling motion at the worst angular rates considered (14.7rpm for the 
SSV ) . ability of the crew to evaluate sensory cues as to 
the direction of spin motion in space cannot be determined from 
current data. Determining the correct direction in which to push 
off from the spacecraft into space may be difficult, however, 
particularly for the more severe tumbling cases. 
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. A number of relatively simple methods for reducing or arresting 
the tumbling of the individual crewnen after they have abandoned 
the spacecraft are possible. These allow the crewnen to be 
recovered by a standby rescue spacecraft. The two-man cable 
despin concept is the preferred one, with the extendable cable 
and the extendable rod despin concepts also being attractive 
potential concepts. 

Recommendations made are as follows? 

•• The two-man cable despin and extendable cable despin concepts 

(Fig. 5-2 and 5-3) should tentatively be considered as the preferred 
modes for abandoning out-of-control manned spacecraft* 

, The sources of tumbling, potential angular rates, and the \ 

feasibility of crew escape by the methods recommended should be 
re-evaluated at appropriate milestones in the development of the 
shuttle and other manned spacecraft. 

. Research should be initiated into crewmen 1 s ability to evaluate I 

sensory cues in a tumbling spacecraft and vhile tumbling in space. 

The objective would be to determine if untrained personnel can 
make the decisions necessary for their ^afe escape and rescue, 

5.2 TUMBLING CONDITIONS 

5.2.1 Torque Producing Emergencies 

Five potential sources of uncontrolled torque were considered in determining 
worst case tumbling conditions. These are: 

. Collisions between two vehicles 

. Escaping cabin atmosphere 

. Escaping stored gas or fluid 

. Hard-over gimballed engine 

. Malfunctioning reaction control thruster 

It is important to recognize that for seme of the emergencies there is no 
clearly definable f, worst case 1 ’. This is so especially for collision, in which 
collisions at progressively larger velocities can be postulated; the limiting 
case is when catastrophic destruction of the vehicles occur. Similarly with 
hard-over gimballed engines and malfunctioning thrusters, enough propellants 
are carried on board, that rotational rates can result which would cause 
structural failure of the vehicles, and loss of personnel from the centrifugal 
forces. These situations were, therefore, limited by rational with aroitrary 
decisions as follows: 

. Collision -1.5 m/s (5 ft/sec) 
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. Hard-over gimballed engine - 15 seconds firing time 

. Malfunctioning reaction control thruster - 60 seconds firing time 

It is also assumed, as part of the emergency, that all attitude control 
or attitude rate control capability is lost following the buildup of angular 
rate. 


5.2.2 Maximum Tumbling Rates 

The maximum tumbling rates which can occur from the emergencies considered 
were determined in a study performed by Pennsylvania State University. This 
study was performed under NASA G^ant NGR 39-009-210, and was based on mass 
property and other data supplied uy NR/SD. 

The results are summarized in Table 5-1. 

The worst angular rate results from an escaping atmosphere on the small 
space vehicle. The maximum rate of 52 rpm produces an acceleration of over 20 
g at the extremities of the vehicle, and would probably result in structural 
failure. This case is, therefore, not a case that could be survived if the 
leak occurred in the worst case condition as considered here. 

5.3 ARRESTING TUMBLING BY EXTERNAL MEANS 

This section identifies concepts for arresting the motions of tumbling 
spacecraft by means external to the tumbling spacecraft, and analyzes and 
evaluates these concepts. 

5.3.1 Concepts for Arresting Tumbling 

Twenty-three different concepts for arresting tumbling by external means 
have been identified. These are based on concepts developed at NR/SD on studies 
for despinning the ATS-V (unmanned) satellite by using a remote maneuvering 
unit, and on concepts identified specifically for this task. These are listed, 
illustrated, and briefly described in Table 5-2. The evaluation of these 
concepts is presented in succeeding sections. 

5 . n , 2 Evaluation of Concepts for Arresting Tumbling 

Evaluation of the candidate concepts was performed in three steps, reducing 
the number from 23 to 15, then to 5, and finally to the two selected concepts. 
The following set of evaluation criteria was postulated for use iu the Tirst 
screening of the concepts: 

• Suitability tor multi-axis tumbling 
. Scheme complexity 

. No dynamic interaction with manned rescue vehicle 
. Compatibility with large configurations 

The screening results are presented in Table 5-3. 
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Table 5-1. Summary of Maximum Tumbling Rates 
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Table 5-2. Candidate Concepts for Arresting Tumbling (Cont.) 

Number and Title Description 

16. Gas Bag Place a bag around the vehicle, close it and then pressurize it. Slowdown occurs 

h i * m through windage losses. 
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Table 5-3. Evaluation of Concepts for Arresting Tumbling 


Evaluation Criteria 


Selection 
for Further 
Study 




Requires prepared passive 
damper, needs docking ring 
on c.g. along principal 
axis 


Needs passive damper, 
does not need docking ring 


Requires special structural 
provisions to withstand 
local loads, analysis will 
be difficult 


Needs passive damper, may 
physical damage vehicle 


Better to use unmanned tug 


Coarse corrections, struct- 
ural damage from blast, 
requires frequent reposi- 
tioning of rescue vehicle, 
not suitable for roll on SSV 


Probably physical damage 
to vehicle 


Localized structural damage 
from concentrated load 
application, requires G&C 
for propulsion packages, 
not suitable for roll onSSV 


Gimbal complexity is high 
and benefits uncertain 


Potential structural damage 


Needs passive damper, 
structural damage, no 
docking ring required 


Probably less structural 
damage than 11, best of 
grasping types 


Coarse corrections, 
inefficient 
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Table 5-3. Evaluation of Concepts for Arresting Tumbling (continued) 


I 

\ 


> 

X 
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Evaluation Criteria 



Concept 

No. 

Title 

Multi-Axis 

Tumbling 

Scheme 

Complexity 

Interaction 
with Rescuer 

Compatibility 

Selected 
for Further 
Study 

Remarks 

14 

Remote Controlled 
Tug 


X 


S' 

S' 

— 

15 

Cloud of Balls 


1/" 


s' 

S' 

Space junk residue, not 
suitable for roll on SSV 

16 

Gas Bag 


X 


X 

s' 

Bag deployment and 
closure complexity; 
collisions between 
vehicle and bag 

17 

Gas Stream 

i/' 

S' 


s' 

S' 

Gas stream dispersal, not 
suitable for roll on SSV 

18 

Induced Eddy 
Currents 

i^ 

X 

S 

s 


— 

19 

Foam 



S 

s 

S' 

Visibility problems in 
approachirg vehicle after 
despin 

20 

Remote Controlled 
Net 


s 

X 

IS 

s' 

... 

21 

Rope Projectiles 


s 

S' 

s 

s' 

- 

22 

Net and Rods 


X 

s 

s 

s' 

Potential structural damage 

23 

Stick“0n Rockets 

n/ 

✓ 

s 

S 

s 

— 


i 









LEGEND: 









S Means satisfactory or unknown 
X Means poor 

XX Means unacceptable 
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The fifteen concepts which survived this initial screening were considered 
for further study* In the second step of the evaluation a preliminary sizing 
analysis of the 15 concepts resulted in rejection of 10 of the concepts. The 
rejected concepts and the rationale for their rejection are listed in Table 5-4. 


Table 5- 4. Rationale for Rejection of Concepts for Arresting Tumbling 


Concept 

Reason for Rejection 

. Towed net 

Complex, non-analyzable 

. Exhaust plume blast 

Operationally impractical 

. Projectiles 

Limited Applicability 

• Cloud of balls 

Low efficiency, space debris left in orbit 

• Gas bag 

Container development, operational com- 
plexity, potential damage to gas bag or 
tumbling vehicle 

. Gas stream 

Low efficiency, high weight penalty 

* Eddy current damping 

Excessive power requirements (hundred of 
kilowatts) 

. Foam 

Operationally impractical 

. Rope projectiles 

Excessive weight 

* Nets and rods 

Excessive weight, questionable feasibility 


The remaining 5 concepts are: 

. Despin mechanism 

. Water stream 

. Remotely controlled tug 

. Remotely controlled net 

. Stick-on rockets 

Some salient features of these five concepts are compared in Table 5-5. 

In the final screening, the following selection criteria were applied to 
the five potentially acceptable concepts to arrive at those recommended. 

. The preferred concept must involve low investment costs (i.e. # 
development and manufacturing costs before use), since large 
funding levels are unlikely to be made available for such 
contingency devices* 

. Operating costs must be reasonable 

. fhe device, once developed and built, must be available for 
operations at very short notice (hours to one day, consistent 
with a shuttle emergency flight)* 
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. The device should be able to deal with a wide range of tumbling 
vehicle size and configuration (including, if possible, the many 
unmanned vehicles expected in orbit), and of angular rates* 

. It should be capable of being operated with a minimum of 
training and simulation, and preferably not require a 
specialized crew. 

. There should be good confidence that the system will be effective, 
with adequate margin for miscalculations, errors, and special 
contingencies. 

The concept that is judged to best satisfy these criteria is the preferred 
concept. The evaluation of the five concepts according to the above evaluation 
criteria is ultimately a matter of judgment. The judgment used is documented 
in Table 5-6. 


Table 5-6. Evaluation of Five Concepts 


Criteria 

Despin 
Mech with 
Inflatable 
Jaws 

Water 

Stream 

Remotely 

Controlled 

Tug 

Remotely 

Controlled 

Net 

Stick-On 

Rockets 

Low investment 
cost 

Moderate* 

Excellent 

Moderate* 

Moderate 

Good 

Reasonable 
operating costs 

Moderate 

Good 

Moderate 

Good 

Good 

Operationally 
available at 
short notice 

Moderate 

Excellent 

Moderate 

Moderate 

Excellent 

Wide range of 
applicability 

Poor** 

Good 

Moderate 

Good 

Good 

Minimum crew 
training 

Moderate 

Good 

Moderate 

Excellent 

Good 

Good confidence 
with adequate 
margins 

Moderate ! 

Good 

Moderate 

Moderate 

Good 

Minimum damage 
to tumbling 
vehicle 

Moderate 

Good 

Moderate 

Moderate 

1 

Moderate 


* Assume existence of developed tug, mini-tug, or remote maneuvering 
unit 


** Not suitable for large vehicles 
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Some of the rationale for these judgements are presented below. 

, The despin mechanism, remotely controlled tug, and remotely 
controlled net require development of fairly complex mechanisms 
and/or propulsion systems. The stick-on rockets can use 
existing rocket motors, but the attach mechanism requires 
developing and testing. The water stream concept can basically 
use off-the-shelf components, but requires analysis, development 
and testing of the nozzle. In addition, as shown by the asterisks 
in the table, the despin mechanism, and the remotely controlled 
tug are feasible only if a tug, mini-tug, or remote maneuvering 
unit have already been developed and are available. 

„ The operating costs of each concept are basically the costs of 
one emergency shuttle flight. Additional costs, such as special 
checkout and ground support, are small relative to the shuttle 
costs. The remotely controlled tug, however, does involve the 
flight f 9ome kind of tug, which significantly increases opera- 
tional costs, 

. The water stream concept can be taken on-board as a 

shuttle payload with very little preparation, and requires only 
filling of the water tank. Similarly, the stick-on rocket concept 
requires only flight preparation of the solid rocket motors. The 
other three concepts, however, involve liquid propellant systems, 
which require some time for loading and checking out. This may, 
indeed, be the limiting factor in launching the shuttle with these 
Concepts. 

• The despin mechanism is capable of use on the small space 
vehicle only, or small unmanned satellites. It is not 
applicable to large vehicles, such as the orbiter or space 
station. 


The water stream and stick-on rocket concepts are relatively 
simple to operate and, because they are incremental in their 
application, a large degree of trial and error during use can 
be tolerated. Practice on a simulator may even show that the 
water stream may be operated intuitively (providing visibility 
and illumination are adequate). Intermittent use would allow 

pauses for evaluation of results. Similar simnlicitv of ooert 
tion may be possible with the stick-on rocket concept. The 

remotely controlled net may also be very simple to operate, 
requiring only control of the net trajectory to intercept the 
target. The other systems appear to require much more train- 
ing and practice, however, and would almost certainly require 
a specially-trained crew, with considerable experience on a 
simulator. 
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. The water stream and stick-on rocket concepts, because of 
their simple reliance on basic momentum transfer principles, 
provide the best confidence that they can successfully arrest 
the tumbling spacecraft. Their incremental use, again, adds to 
the confidence, since considerable errors in use can be tolerated. 
The other three concepts are more complex, and must basically 
operate the first time. All concepts can be sized so that they 
have a margin of at least two or three times to allow for errors. 

. The water stream concept should result in mininal damage 
since very low impingement pressure are experienced on the 
tumbling vehicle. The other concepts can result in damage, 
particularly to appendages. The stick-on rockets may require 
penetration of the structure to operate successfully. 

5.4 DESCRIPTION OF RECOMMENDED CONCEPTS 


5.4.1 Water Stream Concept 

The rescue vehicle contains a water tank, pump, and a remotely controlled 
nozzle. The jet of water is directed by positioning and orienting the rescue 
vehicle so that the water strecm impinges on the tumbling vehicle so as to 
reduce its angular momentum. As the stream will be visible and will move in 
a straight line, the operator can easily adjust the rescuing vehicle orienta- 
tion so that the stream impacts the tumbling vehicle at the desired point. 

The water can be applied in bursts to maximize efficiency and to allow evalua- 
tion of the results in real time. The reaction of the water jet on the 
rescuing vehicle can be counteracted by the attitude control system. 


A practical working range for the water jet velocity is of the order of 
30 to 120 m/s (100 to 400 fps) with corresponding pump pressures in the range 
of 5 x 10^ to 8 x 10^ N/m 2 (70 to 1100 psi). Nozzle thrusts should be in the 
range of 50 to 500 N (10 to 100 lb) with nozzle area within the range of 0.05 
cm 2 to 10 cm 2 (0.01 to 1.5 in. 2 ). As the fluid stream wil^ travel a fairly 
long distance before impact — perhaps 60 m (200 ft) — the impact area will be 
significantly expanded from the nozzle area. As a matter of fact it is 
desirable that the stream cross section expand to spread the load over a large 
area and reduce the effective impact pressure. Pressures of 5 to 500 N/m 2 
(0.1 to 10 psf) and impingement areas in the 1 to 10 m 2 (10 to 100 ft 2 ) range 
are practical. The fluid tank will have a volume on the order of 15 m 3 
(500 ft 3 ). 


An estimate of the weight of water required is shown in Table 5-7, assuming 
an application efficiency of 50 percent and a stream velocity of 122 m/ s (400 
fps). It is estimated that the tankage, plumbing, pumps, and other equipment 
could be provided for another 1350 kg (3000 lb). 


The total energy required, assuming a stream velocity on the order of 
120 m/s is within the present support capability of the shuttle (less than 50 
kwhr). Peak power on the other hand represents a potential limitation on this 
concept. The present or biter power transfer capability is in the 1 to 10 kw 
range. The system may require a special power supply for the move severe 
cases. 
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Table 5-7. height of hater Required to Arrest 
Worst Case Tumbling 


Configuration 

Weight of Water Required 
kg (lb) 

Integral tank orbiter 
Drop tank orbiter 
Modular space station 
Small space vehicle 

6500 (14,400) 

1970 ( 4,350) 

7270 (16,100) 

676 ( 1,490) 


Since only low impingement pressures are experienced, no damage to the 
tumbling vehicle is anticipated. A finely atomized stream appears desirable to 
minimize high localized impingement pressures; local impingement pressures vary 
inversely as the drop diameter. This still applies even if the drops are 
frozen. 


Since the water expands to a vacuum, some evaporation may be expected, and 
the remainder of the water will turn into ice. The lower the initial tempera- 
ture of the water, the less the amount of evaporation. For a water near to the 
freezing point, approximately 14 percent will evaporate at a maximum. This gas 
stream will still be directional, however, and will contribute to the momentum 
transfer if it impinges. 

Reaction propellant requirements to counteract the nozzle thrust of the 
rescuing vehicle are small and within normal capacities. An attractive feature 
of the concept is that* the working fluid is clean in terms of the residue left 
ir orbit. 

Details of the water stream kit installed in the rescuing orbiter 
are shown in Figure 5-4. The kit consists of a water tank, a motor/pump/ 
nozzle assembly, a pressurizing gas bottle, a floodlight, a battery pack and 
associated controls, and a payload retention consisting of a simple welded 
structure. Since the whole kit is well within the orbiter 1 s payload capacity, 
all components are designed like ground equipment rather than spacecraft equip- 
ment. Standard materials and large factors of safety can be used to reduce 
costs and testing. The water tank is spherical, about 2.8 m (9 ft) diameter 
and made of steel. It contains a rubber bladder for positive expulsion of water. 
This is pressurized to 14000 N/m^ (20 psi) from the high pressure (21 x 10° N/m% 
3100 psi) nitrogen tank. The water pump is an axial flow swash-plate piston 
type, which allows for a large range of flow rate and pressure. This is driven 
by a variable speed 10 kw dc electric motor with solid-state control. The motor 
is water jacketed and is cooled by the water flowing through the jacket as it is 
being pumped through the nozzle. The whole of the motor and pump is enclosed in 
a pressurized 1 atmosphere air or nitrogen environment to avoid design and qual- 
ification for a vacuum environment. The tanks and the motor and pump are insu- 
lated for thermal protection. The whole kit is supported in the orbiter cargo 
bay by a 5-point attach system, which fits into the standard cargo bay attach 
points. 
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If more water is required than can be accommodated in one kit, two kits 
may be loaded in the cargo bay. 

5.4.2 Stick-Qn Rocket Concep t 

Small solid rockets are "shot" from a "gun" on the orbiter at low velocity 
toward the tumbling spacecraft. These do not have any onboard guidance and are 
spin stabilized. They attach themselves on impact, which initiates ignition of 
the single nozzle engine (thrusting toward the attach point). Many rockets are 
reauired to accomplish despin. Visual cues and simple computer functions are 
required to determine tumbling rate and rocket launch time. Rc kets require 
variable timers and possibly thrust termination capability to bring the tumble 
rate to near zero; or they can be sized small enough to produce the dusired 
fine control. 

Individual rockets viiich may unintentionally attach on the wrong side of 
the center of gravity, or which become badly deflected after attach, would add 
to the momentum instead of reducing it. For this reason a lot of small rockets 
are preferred, with visual feedback of where they hit. 

The rockets were sized to remove all the spacecraft tumbling rate speci- 
fied in Table 5-1. The effect of impact provides an additional, though small, 
despin impulse. Half the weight of the module was assumed to be propellant. 
Modules are envisioned to be solid propellant engines weighing approximately 
10 to 20 kg (20 to 40 lb) each. Weights of the modules presented in Table 
5-8 show that a propulsive means of removing angular rates is an order of 
magnitude more efficient than any other means. 

Table 5-8. Weights and Number of Stick-On Rockets 
to Arrest Worst Case Tumbling 




Vehicle 



Integral 

Tank 

Orbiter 

Drop Tank 
Orbiter 

Modular 

Space 

Station 

Small Space 
Vehicle 

Total module 
weight, kg (lb) 

277 (610) 

75 (165) 

304 (670) 

32 (70) 

Approximate number of 
modules required 

14 - 28 

4-8 

15 - 31 

2-4 


A single size stick-on rocket is applicable to the multiaxis tumbling of a 
wide range of configurations (except possibly for the roll axis of a symmetric 
configuration) and has the lowest weight of any concept. No dynamic interaction 
between the tumbling spacecraft and rescue vehicle is inherent in this concept. 
Although recognition of body rates from inertial motion observation may be 
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difficult, it is felt that the difficulty can be overcome with ground simula- 
tion and training. Adequate visual cues exist for aiming and launch timing 
but could be supplemented by simulation and training. 

The major potential technical development problem is development of the 
attach mechanism. In the concept shown in Figure 5-5, the flat plate ha ' a 
serrated surface on a pneumatic pad. This spreads the contact load over its 
whole area (to avoid damage to the spacecraft surface) and also provides a lot 
of friction to prevent sliding over the surface. A protruding trigger initiates 
firing of the rocket motor immediately upon contact, and the rocket thrust, 
combined with the friction of the pad, maintains the initial orientation of the 
rocket against the spacecraft surface. 

The rocket is spin-stabilized at about 5 rpm in its trajectory toward 
the tumbling spacecraft. (This is a low enough rate that it does not pose any 
problems for attachment) . The she pe shown for the rocket is designed for good 
dynamic stability in flight, at contact, and during firing. The surface con- 
tacted may vary by as much as 20 degrees from the normal to the flight, path of 
the rocket with very little loss in effectiveness in reducing the angular 
momentum. At larger angles, of around 45 degrees, the friction may initially 
be insufficient to hold the rocket firm, and it may settle at an angle that 
introduces unwanted components in momentum. Since a large number of rockets 
will be required to stop the tumbling, however, it is only necessary that they 
are correctly oriented on the average. If an occasional rocket makes contact 
on the wrong side of the center of gravity, or misses altogether, the effect 
can be corrected by subsequent rockets. Because of their high specific impulse 
these rockets are very efficient in terms of weight and a much greater supply 
than the theoretically required minimum can be carried on a given mission. 

Rockets which miss the spacecraft will be fired by a timer to reduce the 
hazard of collision with a spacecraft at a later time. 

When the rockets are spent the friction force will vanish and the empty 
motors will each take up an independent trajectory, away from the spacecraft. 
These spent rockets thus become space debris, and a hazard to other spacecraft. 

An alternative rocket design which avoids this problem is shown in 
Figure 5-6. In this concept the front plate is mounted on a ball joint, so 
that the plate can adjust itself to the surface of the spacecraft immediately 
upon contact. When a trigger in the center of the plate makes contact with 
the spacecraft, three things happen simultaneously. First, a number of spring- 
loaded pins are shot out from the plate, penetrating the contact surface, and 
latches in the pins lock the plate against the surface. Secondly, the ball 
joint is locked by a friction device so that the rocket retains its flight 
path orientation relative! to the spacecraft surface, irrespective of the 
surface angle, xhirdly* the rocket motor firing is initiated. A timer is 
again provided to fire rockets which miss the spacecraft. 

Details of the installation of the rockets in the rescue orbiter cargo bay 
are shown in Figure 5-7. The individual rockets are stored in a magazine, and 
are fed one at a time into a launching device. This is electrically operated, 
and controlled by the rescue orbiter crew. The rockets are propelled by springs 
or pneumatically along a guide rail, which also imparts the spin. 
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Figure 5-7. Stick-On Rocket Kit in Orbiter Cargo Bay 
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5.5 ESCAPE FROM A TUMBLING VEHICLE 

This part of the study was directed toward the dynamics aspects of 
retrieving the crew from a disabled, tumbling spacecraft. It is assumed that 
a rescue vehicle cannot dock with the distressed craft and due to the tumbling 
motion the rescue vehicle must stationkeep at some safe distance. It is, there- 
fore, necessary to somehow move the crew of the disabled vehicle far enough away 
that they can be retrieved without the danger of a collision between the tum- 
bling vehicle and the rescue vehicle. It is furthermore assumed that the dis- 
abled spacecraft does not include any t>pe of escape vehicle. Thus the study 
is restricted to consideration of the case where crewmen leave the vehicle in 
pressure suits with individual life support backpacks. Once safely away from 
the tumbling craft, the crewmen are picked up by the orbiter, perhaps with the 
aid of a manipulator. 

5.5.1 Crew Capability 

The crewman upon leaving the tumbling spacecraft will have the angular 
rate of the spacecraft and a linear velocity relative to the spacecraft equal 
to the instantaneous velocity of that part of the spacecraft relative to its 
center of gravity at the instant of separation. In addition, he will have 
superimposed whatever motion he is capable of imparting to himself by physically 
pushing off against the spacecraft. 

The crewman is able to provide a relative separation velocity between 
himself and the spacecraft oy pushing off when leaving. An estimate of this 
velocity is made based upon man’s ability to jump. On earth the 50 to 95 
percentile man in good physical condition can raise his center of gravity 0.3 m 
(1 ft) . In zero g this is equivalent to pushing off with an initial velocity 
of 2.5 m/s (8.0 fps) . As an escaping crewman he will be encumbered with a space 
suit and a portable life support system (FLSS) , and his separation velocity is be- 
tween 1.7 and 1.8 m/s (5.5 to 5.9 fps) for the 50 and 90 percentile man respectively. 

The escaping crewman is capable of changing his tumbling rates by changing 
his inertia or by motion of his extremeties. He is capable of little, if any, 
damping without additional equipments If the crew could leave the tumbling 
spacecraft at 14.7 rpm (for the SSV) in a crouched position (which would 
be very awkward), the best he could to by extending his extremeties would be 
to reduce his tumbling rate to approximately 5 rpm. Continual motions of the 
arms could reduce the crewnan’s head and trunk angular rates; however, termination 
of the motion would restore the initial tumbling rates. Supplementary equip- 
ment is thus required to reduce the tumbling rates further and if possible 
permanently. 

5.5.2 Configuration Evaluation 

The analysis of the mechanics of escape from complex configurations such 
as are involved here is extremely complex for the general case of multi-axis 
tumbling because of the complex geometries involved. As a first approach, 
therefore, the capability of the crew to escape from the tumbling vehicles as 
they are instantaneously rotating about each of their principal geometric axes 
was analyzed. It is felt that since sufficient separation velocity margins 
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exist for these representative cases, there is nothing inherent in multi-axis 
tumbling that would significantly increase those separation velocity require- 
ments . 

Each of the four configurations is analyzed separately in what follows. 
These analyses show that the crewmen can escape without recontact or inter- 
ference within the structure either by just stepping off, or with a slight push- 
off well within tne normal physiological capability, assuming that they can 
make the necessary judgments. 

A. Integral Tank Orbiter 

The worst case initial condition was assumed to be a yaw rate of 4 rpm. 

All exits were assumed to occur from the hatch located on the upper surface 
of the fuselage behind the cockpit. Leaving from this point with no additional 
velocity and the nominal center of mass location, the crewman easily clears the 
tail fin. The center of mass could be 12 m (40 ft) further forward and the 
natural tangential velocity would be adequate for safe escape. 

In the case of pitch motions, the procedure is a function of the direction 
of spin. For a negative pitch motion, the crewman simply steps off and the 
tangential velocity provides adequate clearance with the tail. For positive 
pitch motions, the crewman climbs out and pushes slightly in the Y axis direction 
The object is to slide over the side of the fuselage. Once clear of the fueselage 
the tangential velocity will provide adequate aft fuselage clearance. 

For roll motions of the vehicle, the crewman exists at the same point but 
pushes away along the Z axis. 

B. Drop Tank Orbiter 

The drop tank orbiter configuration was analyzed assuming a spin about the 
yaw axis at a rate of 2 rpm. A sketch of the configuration is shown in Figure 
5-8. For this vehicle the crew would escape from the docking port shown in the 
sketch. 



Figure 5-8. Drop Tank Orbiter Configuration 
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For nominal, orbital center of mass locations, no additional velocity is 
required. The tangential velocity associated with the sp‘n is adequate to 
safely clear the vehicle. The mass center could be 8 m (26 ft) further for- 
ward before the tangential velocity alone was not sufficient to properly clea r 
the vehicle. With a ma3s center approximately 13 m (42 ft) forward of nominal, 
an additional velocity of 0.14 m/sec (4.6 fps) would be required. This is well 
within a man's push-off capability. 

For a negative pitcn rate the crewman simply "steps off" and the analysis 
presented above for yaw motion is applicable. Tangential velocity alone is 
sufficient to clear the tail. For a positive pitch rate, the crewman should 
plush slightly in the plus or minus Y direction such that he will slide along 
the nose of the vehicle. Collision with the aft fuselage will not occur as 
the relative motion computed for the yaw case is essentially applicable. 

For rolling motion of the orbiter, the crewman would exit at the same 
point but push to provide a velocity toward the nose of the vehicle. 

It appears from this analysis that escape from the drop tank orbiter can 
be ac omplished with no more than a simple push-off to obtain the required 
velocity. 

C, Modular Space Station 

For the specific cases of single axis motion about ^ach of the body axes, 
it was determined that crew escape can be accomplished using the natural 
tangential velocity of the vehicle. In some cases a slight push-off is advantageous. 
The solar arrays can be positioned to facilitate escape. Although the case of 
a random tumble was not analyzed, it is believed that a more detailed analysis 
would show that escape can be accomplished safely. 

D. Small Space Vehicle (SSV) 

The most critical case for this vehicle is the case where the vehicle has a 
single port near the mass center. It is necessary to evaluate the relative 
velocity required to prevent a collision. The analysis is valid for the 
vehicle spinning about either the Y or Z axis. Velocity addition in the 
tangential direction is more efficient than in the radial direction. A 
representative sketch is shown in Figure 5-9. This sketch illustrates the 
escape process, including the path of the crewnan, and the critical point 
the crewman has to clear to avoid a collision. 

The results of the analysis are presented in Figure 5-10. The plot shows 
the additional velocity required as a function of the distance between the 
escape port and the vehicle center of mass assuming a total vehicle length of 
11.3 m (37 ft). Two tumble rates are shown. Safe escape occurs without 
velocity addition as long as the vehicle mass center is more than about 2 m 
(6.5 ft) from the escape port. Assuming a crewman can push off and obtain a 
relative velocity on the order of 1.8 m/s (6 fps) then he could safely leave 
from the mass center for tumble rates of 5 rpm or lower. The additional 
velocity should be applied in the spin plane and in a direction to add to the 
tangential velocity at the moment of exit. 
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In some cases it may be desirable to push off slightly out of the spi.* 
plane. The advantage is that the crewman need travel only a distance equal 
to ‘.he radius of the vehicle and he will be clear. 


5.5.3 Crew Tumbling Arrest Concepts 


As has been discussed, the crewman cannot permanently stop his tumbling 
action without additional equipment to aid him. A number of concepts have 
been devised to perform this function. These concepts are: 


Manually cranked flywheel despin device - reduces the crewman’s 
body tumbling rate by hand cranking a flywheel 


Reaction control despin device - uses a cold gas reaction control 
for reducing the tumbling 


Two-man cable despin device - the crew leave the tumbling 
spacecraft in pairs holding hands and then pay out a cable 
between them to reduce their angular rate. Rope lengths on 
the order of 3 m (10 ft) appear to provide tolerable spin rates 
(approximately 1 rpm). When despun to a comfortable level, the 
crew could release the cable; howevei , their linear separation 
rate could pose recovery problems. The relative translational 
velocity of the two men while attached to the cable is low 
(approximately 0.3 m/s, 1 fps) , so that the crew will not 
"crash* 1 into the rescue vehicle. 


Extendable cable despin "evice - a long cable with a small mass 
attached to its end is gradually extended. 


Weighted cable despin - a cable with an attached weight is 
twirled by the crewman about the appropriate axis to bring his 
head-trunk angular rate to zero. He then lets go of the device, 
leaving himself despun. 


Extendable rod despin device - two pairs of rods extend in the 
Y and Z directions from the PLSS. The rods are 23 m (75 ft) 
long and each weigh about 1 kg (2 lb). 


These devices must be able to absorb the angular momentum associated with the 
maximum tumbling rate considered (1A.7 rpm) and the crewman leaving the tumbling 
spacecraft in a standing position. 


The concepts are illustrated and sizing information is $;iven in Figures 
5-11 to 5-18. 


SD 72-SA-0094-1 





Wheel Diamete 


+(i) 


0.1 


10 


3 


I I V 1 » ■ I 


Wheel Speed, rpm 


T 



Figure 5-11. Flywheel Characteristics for 
Manually Cranked flywheel Despin Device 
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Figure 5-12. Two-Man Cable Despin Device 



Figure 5-13. Characteristics for Tiro-Man Cable Despin Device 
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Figure 5-14. Extendable Cable Despin Device 
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-18. Extendable Rod Despin Device 
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Ik evaluating the six crew tumbling arrest concepts described, the following 
evaluation criteria were used: 

. The selected concepts should be able to reduce the angular rate 
from the maximum expected rate (14.7 rpm) to an acceptable rate 
for recovery by the rescue vehicle (assumed to be 1 rpm or less). 

. The devices should be simple to operate, require no specialized 
training by the crewmen, and pose no additional hazards to them. 

. The devices should preferrably make use of materials and equipment 
readily available, rather than consist of equipment specifically 
developed for the purpose of arresting tumbling crewmen. 

. The devices should not interfere with retrieval of crewmen by the 
rescuing vehicle. 

. The devices should allow usage by incapacitated or unconscious 
crewmen (with help from fellow crewmen). 

Table 5-9 summarizes the evaluation of each of the six concepts considered 
against the above criteria. The criteria have been phrased so that "Yes" 
answers are favorable to a concept and "No* 1 answers unfavorable. 

The table shows that the two-man despin concept satisfies all the evalua- 
tion criteria. None of the other concepts meet all the criteria. 

It should be noted that this concept does not necessarily need two crewmen 
for operation. The second crewman can be replaced by any suitable massive 
piece of loose equipment secured to the cable. The cable similarly is not a 
specialized cable, but could be any suitable cable, such as a torn-out length 
of electrical cable, secured to the crewman’s suits in such a way that it can 
gradually be let out. Strength requirements are minimal., since only small 
centrifugal forces are experienced. 
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6.0 ESCAPE, RESCUE, AND SURVIVABILITY 


Crew safety is of prime importance in the design of any manned system, 
and many provisions are incorporated in spacecraft to prevent accidents and 
to deal with emergencies. The most desirable type of provisions are those 
which prevent hazards or accidents from occurring, followed by provisions to 
deal with emergencies when they have occurred and to restore the spacecraft 
to a safe operational status. The ultimate safeguard, however, consists of 
provisions for escape or rescue from a spacecraft which can no longer safely 
sustain the on-board personnel. 

The purpose of this task was to review and analyze escape, rescue and 
survivability concepts defined in earlier studies, and to determine the 
feasibility of these concepts for the shuttle, manned sortie modules and 
modular space station. The most applicable of these concepts were to be 
identified, and studied for adaptation to crew sizes of up to 6 or 12 men, 
appropriate to later sortie missions in the orbiter and to the space station. 
Where adaptation of these concepts is not considered practical, new concepts 
were to be conceived and their design and operational requirements determined. 

Escape, rescue, and survivability are defined as follows: 

o Escape : The use of a vehicle, without outside assistance, to effect 

egress from a manned spacecraft which requires evacuation, and to 
return to earth. 

o Rescue : The use of outside assistance by means of separately based 

vehicles to effect a return of personnel from the distressed or 
survival vehicle to a permanent safe haven. 

o Survivability : The use of a vehicle or equipment to separate from the 
distressed spacecraft and provide a safe haven in orbit for personnel 
until rescue can be effected. This is to be distinguished from 
on-board survivability, as discussed in Section 4, which refers to 
ability for personnel to survive until restoration of a habitable 
environment or until rescue in a separate section of the distressed 
spacecraft. 

Ground rules and assumptions were as follows: 

o There is a need for abandonment from each of the three models (shuttle 
orbiter, sortie module, space station) being evaluated. The reasons for 
requiring abandonment are not to be analyzed in this task. 
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o The shuttle will be in inventory for space station operations. 

o The sortie module is always attached to the shuttle orbiter while 
manned . 

o The escape, rescue or survivability devices are intact and accessible 
following the emergency. 

o Crew assignment for each model shall be as follows : 

o Shuttle - Minimum of 2 crewmen. The maximum number is that which 
is compatible with the selected concept (s). 

o Shuttle/Sortie Module - 4 to 10 men, including 2 shuttle crewmen. 

o Space Station - 6 crewmen for initial station and 12 for growth 
station. 

o Adequate time will be available to activate, checkout and deploy any 
on-board concept considered. 

o Escape and survivability concepts allow personnel abandonment of the 
distressed vehicle within hours of the emergency. Rescue concepts can 
reach the distressed vehicle or the survivability vehicle within a 
few days. 

No attempt has been made in this study to determine possible causes for 
requiring abandonment of the spacecraft, to determine the statistical probab- 
ility, absolute or relative, of such causes, or to determine how much time is 
available to the on-board personnel for escape or rescue. In all the evalu- 
ations it is assumed that the potential escape, rescue, or survivability devices 
are accessible to the personnel, that they are able to operate them, and that 
they have sufficient time to do so. 
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6.1 CONCLUSIONS AND RECOMMENDATIONS 

Conclusions and recommendations reached are as follows; 

o The shuttle orbiter should be the primary vehicle for dealing with 
emergencies of manned vehicles in earth orbit. A shuttle orbiter 
should be available for rapid emergency rescue whenever manned 
earth orbital flight is in progress. This need not be a dedicated 
rescue shuttle or orbiter, but normal operational vehicle on which 
any of a variety of rescue kits could replace the planned payload in 
an emergency. 

o If there Is a time period at the beginning of the shuttle program 
(or during the mature shuttle operational period) when shuttle 
rescue is not possible because of the non-availability of a second 
shuttle for rescue, launch pad, or other reason, an Apollo command 
module, called an Escape CM, should be carried in the orbiter cargo 
bay as an escape vehicle. This can be a refurbished command module 
with up to six seats (as required) and with capability for reentry 
from earth orbit and water landing. The CM should be pressurized 
at 8 psi, to allow rapid shirtsleeve entry of the personnel without 
the danger of getting "bends". This Escape CM is the most cost 
effective of the escape and rescue vehicles considered. 

o If a quicker escape or rescue capability is required from the shuttle 
orbiter, sortie modules or space station that can be provided for by 
the emergency shuttle rescue, one of the following approaches should 
be used: 

. The first approach is to include a stripped-down Apollo 

command module as a survivability escape, called a Survivability 
CM, (i.e., a "Lifeboat”) in the orbiter cargo bay. This 
will require no heat shield structure or parachute system, 
and possibly only a minimum restraint system instead of seats. 

• The second approach is to equip a manned sortie module on 
the orbiter or two or more modules on the station as 
survivability modules. These require separation capability, 
an emergency life support system, an attitude stabilization 
system for coarse attitude hold and for docking, and an 
earth communication capability. Survivability will be 
needed for a number of days in orbit, until a shuttle 
rescue vehicle can pick the survivability capsule up and 
return it to earth. 

. Another possible approach is to develop a simple, low cost 
survivability capsule, called an MSV (Modular Survivability 
Module), particularly for use in the orbiter cargo bay. It 
should accommodate the maximum number of on-board personnel. 
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. Refurbished Apollo command modules (Escape CM's) can be 
used as escape vehicles. One would be required on shuttle 
missions; the space station would require more than one 
to provide access from multiple points. This approach is 
only feasible for complements of up to 6 personnel* 

o At some appropriate time in the shuttle program a study should je 
initiated to determine whether escape or survivability capability 
will be required. The study should consider potential time criti- 
calities of emergencies; availability and time of shuttle rescue; 
and design and cost studies of the recommended escape and surviv- 
ability concepts. 
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6.2 CONCEPTS CONSIDERED 
6.2.1 Escape Concepts 

The following eleven escape concepts have been considered: 

o Airmat (Goodyear) 
o Rib Stiffened (NR) 
o Paracone (MDAC) 
o Moose (GE) 
o Encat- 

o Egress (Martin-Marietta) 
o Life Raft (GE) 
o Lifting Body (Northrop) 
o EEOD (NASA/Lockheed) 
o Spherical Heat Shield (NR) 
o Apollo Command Module (Escape CM) (NR) 

These concepts, which were selected from previous studies, are illustrated 
in Figure 6-1, and some of their characteristics ire described. Although the 
concepts selected for evaluation do not include all concepts defined in the 
surveyed studies, they are representative of the scope of the functional, 
operational, dimensional, and weight characteristics of all concepts *eviewed. 

The CM was included because a number of used CM’s nre expected to be 
available in the time period considered, and these could be refurbished and 
modified as necessary for use as escape vehicles. The service module is not 
needed, and probably will not be available. A retro-rocket package, as shown 
in the sketch of the Escape CM, may however be needed for deorbit. 


6.2.2 Rescue Concepts 

Two rescue concepts have been considered. These are: 
o The shuttle booster and orbiter 

o The Apollo Command and Service Module (called Rescue CSM) 
on an S-IB or Titan booster 


The rescue shuttle is a normal shuttle booster and orbiter, whose 
mission is changed to a rescue mission as soon as the emergency has occurred. 
For rescue of personnel in excess of the normal shuttle passenger compartment 
capacity, a rescue kit can be added at short notice in the cargo bay. 


The Rescue CSM is similar in concept to the use of the CSM as a rescue 
vehicle on the Skylab program. In this program a "rescue kit" is kept 
available at the launch site in case of need. This consists mainly of a kit 
to convert the 3-man CM into a 5-man vehible by the addition of 2 extra seats 
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CONCEPT 

NAME 


SCHEMATIC PRESENTATION 


AIRMA1 

(GOODYEAR) 


RIB STIFFENED 
EXPANDABLE 
(NR) 



PARACONE 

(MDAC) 


^^)(STOWED POS) 

RETRO * 

MOTORS \\ 


(FIRING POS> y 
PLSS, SURVIVAL/ 
& RECOVERY-^ 


INFLATION 
& RCS GAS 


, PARA- 
CONE 
STOWED 


MOOSE 

(GE) 


PARACHUTEs 


CZD 

firing! 

POS / 

RETRO / 
MOTOR ^ 


/FOLDABLE 
HEATSHIELD 
✓ PLSS 


STORED 

POS 


"FOAM 


CHARACTERISTICS 


• 2 MAN 

• SUITS REQUIRED 

• INFLATABLE 
•EJECTION SEAT 
•518 KG (1140 LB) 

• NEW TECHNOLOGY REQUIREMENTS 

• FLEXIBLE HEATSHIELD 

• MATERIAL 


• 3 MAN 

• SHIRTSLEEVE ENVIRONMENT 

• MECH RIGID 
•CANISTER 

STORED 

• 660 KG (1452 LB) 

• NEW TECHNOLOGY REQUIREMENTS 

• ARTICULATING RIB-TRUSS 

STRUCTURE 

• MATERIAL 


•1 MAN 

• SUIT 

• INFLATABLE 

• 192 KG (425 LB) 

• NEW TECHNOLOGY REQUIREMENTS 

• LARGE INFLATABLE AND 
DEPLOYABLE STRUCTURE 

• MATERIAL 


• 1 MAN 

• SUIT 

• HAND-HELD RETRO 

• ALL EQUIPMENT 
CARRIED EVA 

• FOAM-1 N-PIACE 

• 215 KG (475 LB) 

• NEW TECHNOLOGY REQUIREMENTS 

• FOAM IN SPACE 
•FOLDABLE HEAT SHIELD 


Figure 6-1. Candidate Escape Concepts 
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TYPE 


CONCEPT 

NAME 


SCHEMATIC REPRESENTATION 


CHARACTERISTICS 


Z 

o 

u 


CD 

< 

>- 

o 


ENCAP 


^^—FOLDABLE HEATSHIELD 
■DEPLOYMENT 
SYSTEM 
• PLSS 


RETRO 

MOTOR 



slM 


INFLATION 
SYSTEM 

RIGIDIZED RIBS 


• 1 MAN 

• SUIT 

• EVA 

• MECH RIGID 

• 24 KG (588 LB) 

• NEW TECHNOLOGY REQUIREMENTS 

• MECHANICAL DEPLOYMENT 

MECHANISM 

• FOLDABLE HEAT SHIELD 


MOVEABLE 

CANOPY 


EGRESS 

(MARTiN- 

MARIETTA) 


RCS — -"fJX PARACHUTE 
& RECOVERY 
' AIDS 


U RETRO 
MOTOR 



• 1 MAN 

• SHIRTSLEEVE ENVIRONMENT 
•EJECTION SEAT 

• 370 KG (820 LB) 

• NEW TECHNOLOGY REQUIREMENTS 

• MOVABLE CANOPY 

NEW HEAT SHIELD 

• MODIFIED B-58 CAPSULE 


SURVIVAL KIT 


EJECTION 

MOTOR 


Q 

g 

DC 


FOAM 

SUBSTRACT 

PERSONAL 

PARACHUTE 


LIFF.RAFT 

(GE) 



/ | v display! 

PANEL 


RETRO 
MOTOR 

HEATSHIELD 


RCS 


• 3 MAN 

• SUITS REQUIRED 

• PERSONAL CHUTES 

REQUIRED 

• 420 KG (936 LB) 

• NEW TECHNOLOGY REQUIREMENTS 

• NEW HEAT SHIELD 

• FOAM MATERIAL 


CONTROLS 
& DISPLAYS 
EARTH 
RECOVERY SYS 


RETRO 

MOTORS 


LIFTING BODY 
(NORTHRUP) 



HEATSHIELD 


• 3 MAN 

• SHIRTSLEEVE ENVIRONMENT 

• 1950 KG (4330 LB) 

• NEW TECHNOLOGY 
REQUIREMENTS 

• NEW HEATSHIELD 

• REENTRY TECHNIQUE 

• HIGH SPEED PILOT 
TECHNIQUES 


Figure 6-1. Candidate Escape Concepts (Cont) 
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TYPE concept 
NAME 


*EEOED 

(NASA/ 

LOCKHEED) 


SCHEMATIC REPRESENTATION 


HATCH ^^ ETR OGRADE MOTCR / 
(40-IN / 


CONTROL! 

IPANEL-^1 




^RtSoXtAL n COMMUNICATIONS, 

EARTH ORBITAL / Ecs & ELECTRICAL 

ESCAPE DEVICE HEAT SHIELD' SUBSYSTEMS 


SPHERICAL HEAT 
SHIELD (NR) 





CHARACTERISTICS 


•3 MAN 

• SHIRTSLEEVE ENVIRONMENT 

• 1240 KG (2769 LB) 

• NEW TECHNOLOGY 

REQUIREMENTS 
• NEW HEATSHIELD 


*2 MAN 

► SHIRTSLEEVE ENVIRONMENT 

► 445 KG (985 LB) 

►NEW TECHNOLOGY REQUIREMENTS 
• NEW HEATSHIELD 


APOLLO 
ESCAPE CM 
(NR) 



• 2-6 MAN 
•SHIRTSLEEVE 
►-4500 KG (10,000 LB) 

• NEW TECHNOLOGY REQUIREMENTS 

• NONE 
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For use as a rescue vehicle for the shuttle and space station operations, 
the CM can be modified to accept up to a total of 6 men. With a launch crew 
of 2, this can be used to rescue up to 4 men. 

This Rescue CSM concept is practical only while a boost vehicle is 
available. The service module is needed to provide power and propulsion 
from launch through deorbit. If an S-IB booster is not available, the Rescue 
CSM could be launched on a Titan. 

Rescue of a distressed vehicle by a space station already in orbit does 
not apr^'ir practical because of the space station limited capability to change 
its o i This was therefore not considered as a practical candidate. 

6.2.3 Survivability Concepts 

Five survivability concepts have been considered. These are: 

o Cocoon 
o Sortie module 
o Space station module 

o Apollo command module (Survivability CM) 
o Modular survivability vehicle (MSV) 

The Cocoon is a concept by the General Electric Company. It consists of 
encapsulating individual suited crewmen in foamed plastic, to afford thermal 
and other protection until rescue. This device is relatively light and simple. 

The sortie module and the space station module as survivability concepts 
would be designed and operated so that in an emergency they can be separated 
from the parent vehicle (the orbiter and the space station respectively) and 
provide the necessary functions for life support and for being rescued. 

Refurbished Apollo command modules can be adapted as survivability 
vehicles (Survivability CM f s). The stripped down Survivability CM could 
accommodate considerably more personnel than the normal complement. Figure 
6-2 shows how 8 men could be accommodated under emergency conditions and 
still allow sufficient room for some mobility and for personal hygiene 
purposes. The figure shows that it is possible to accommodate 10 men, and 
as an extreme upper limit, 12 men. If weight is a limitation, the whole 
of the outside heat shield structure could be removed, and an insulation 
blanket substituted for thermal and meteoroid protection. External systems, 
such as the parachute and uprighting systems, could also be removed. 

The modular survivability vehicle is a survivability concept specifi- 
cally adapted for use on orbiter, sortie missions and on the space station. 

A design concept for this is shown in Figure 6-3 and is capable of accommo- 
dating up to 12 men for approximately 2 or 3 days under emergency conditions. 

It is about the same size as an Apollo CM. The analysis showed that if a 
12-man capacity is required at some time, it does not make sense to consider 
a smaller capsule in addition to a smaller capsule for smaller complements. 

The MSV is described in Section 6.6. 
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6.3 EVALUATION 

The preferred concepts in each of the three categories of escape, rescue 
and survivability, were determined on the basis of the following evaluation 
criteria. 


o Shirtsleeve - Shirtsleeve operations aie preferred to suited 

operations since shirtsleeve operations improve personnel reaction 
time and provide better capability to deal with injured or 
incapacitated personnel. 

o Buddy System - Concepts which use the buddy system (i.e, can 

accommodate 2 or more men) are preferred over single man concepts 
since they allow for attending tc injured or incapacitated 
personnel. 

o Cost - The recommended proach must have a low total cost, i.e., 
development, recurring ond operational. Recurring costs include 
costs of manufacturing, testing, am checkout. Operational costs 
include cost of the supporting iau . '* vehicles and launch facilities, 
and of any required recovery operations. 

o Technology - Approaches using state-of-the-art are preferred to 
ones requiring new technology development. 

o Development Risk - Proven concepts are preferred to new ones since * 

they reduce program risk. New ccncepts with minimum development risk 
are preferred to concepts with high development risk. 

o Launch Vehicles - Concepts which can be used without a separate 
launch are preferred over those which require a separate launch 
or those which require a dedicated spacecraft and launch vehicle. ? 

0 Recovery - Return of the personnel in an orbiter at the shuttle | 

landing site is preferred to a water landing because it does not t 

require complex recovery operations. f 

i 

o Payload Impact - Concepts which have the least impact in restricting I 

the orbiter or sortie payloads because of weight or volume are | 

preferred. | 


The comparative evaluation of the various escape rescue and survivability 
concepts against the evaluation criteria is shown in Table 6-1. Selection of 
the preferred concepts in each of the three categories can be made independently. 

6.3.1 Preferred Escape Concept 

The refurbished Apollo Escape CM with a retro-rocket package is the 
preferred escape concept. 

Comparison of the various factors in Table 6-1 indicates that the decision 
lies broadly between the new concepts on the one hand, and the Apollo Escape CM on the 
other. The most attractive of the new concepts appears to be the Spherical Heat 
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Table 6-1 • Evaluation Escape, Rescue, and Survivability Concepts for 6 Men 
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Shield, since this has all the desirable features at nearly the lowest cost 
of the new concepts. The comparison of this with the Escape CM is summarized 
as follows: 



Spherical 
Heat Shield 

Escape 

CM 

Cost 

High 

Moderate 

Technology 

New 

Current 

Development Risk 

Medium 

Very low 

Payload Impact 

Low 

High 


The deciding factor appears to be the importance of the impact of the 
weight in reducing the payload capacity. If the weight of 5,900 kg (13,000 lb) 
can, be tolerated, the Escape CM is obviously the preferred escape concept. If 
on the other hand potential reduction in escape system weight from 5800 to 
1340 kg (13,000 to 3,000 lb) is vital, the Spherical Heat Shield concept is 
preferable. 

6.3.2 Preferred Rescue Concept 

The Shuttle is the preferred rescue concept. The comparison of the Shuttle 
rescue and the Apollo CSM rescue concepts in Table 6-1 shows that the advantages 
are all in favor of using the Shuttle if it is available. If a shuttle is not 
available for use as a rescue vehicle, escape or survivability concepts appear 
preferable to maintaining a Rescue CSM capability. 

6.3.3 Preferred Survivability Concepts 

The recommendation is to consider four concepts as options for survivability 
concepts, i.e.,:: 

o Sortie Module 
o Space Station Module 
o Apollo Survivability 
o Modular Survivability Vehicle (MSV) 

Comparison of these in Table 6-1 shows that all four concepts are practical. 
The decision as to which, if any, is the preferred concept can be left to later 
studies, when more detailed design and cost data are available. 

Use of the sortie module and space station modules as survivability vehicles 
would be cost effective if these modules are in any case required to have a large 
degree of self sufficiency, e.g., in the environmental control and life support. 
On the other hand there may be many different sortie modules in the program, and 
it may impose a large cost penalty to incorporate survivability provisions on 
each module. In such a case it may be preferable to use a single MSV design for 
all sortie missions . The MSV could also be used on orbiter missions which do 
not include a habitable sortie module. The Survivability CM could be attractive 
if a survivability vehicle appears necessary for a limited number of missions at 
relatively short notice. Development of the Survivability CM from existing CM's 
could require considerably less lead time than development of a new vehicle such 
as MSV. 
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6.4 INTEGRATED ESCAPE, RESCUE AND SURVIVABILITY APPROACH 

Having determined the preferred concepts in each of the three categories 
of escape, rescue and survivability, an integrated approach must be synthesized. 
This integrated approach must satisfy the two following criteria: 

o Commonality - The recommended concept or combination of concepts 
must be capable of providing for the survival of all on-board 
personnel on the orbiter, sortie module, or space station following 
an emergency. That is, a recommendation which cannot deal with all 
the on-board personnel and all the vehicles is not acceptable. 

o Time Criticality - If it is considered desirable to be able to 
abandon the distressed spacecraft within hours rather than days, 
the preferred approach must include escape or survivability concepts 
since rescue may take as long as a few days. Since it is only possible 
to determine whether the time criticality of emergencies may be hours 
or days (or minutes for that matter) on a statistical basis, this is 
treated as a program decision to be made at a later date , and 
recommendations are made for either option. 

The candidate concepts are: 

o Escape : Apollo Escape CM 

o Rescue : Shuttle 

o Survivability : Sortie module, Space Station Module, Apollo Surviv- 

abilitv CM or Modular Survivability Vehicle (MSV) 

In addition, certain assumptions can be made relating to the expected 
development of the Shuttle, Sortie and Space Station programs. These can 
be* summarized as follows: 

o In the early phases of the Shuttle program, the following 
conditions are expected: 

o A shuttle rescue capability may not be available because 
of limited orbiters, boosters or launch pads. 

o The maximum number of personnel in the orbiter will probably 
not exceed 4, possibly 6. 

o The payloads will use less than the full weight or volume 
capacity of the orbiter. 

o The risk of an emergency occurring is greater in this time period. 

o When the Shuttle program matures, personnel complements may increase, 
as a maximum, to about 10 or 12 men. Payloads will generally use 
maximum payload weight capacity, but not maximum volume. Some 
shuttle payloads, such as tugs or large telescopes, may however occupy 
the full cargo bay. 


s*. 
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o By the time a Space Station becomes operational, the Shuttle 
program will be operating on a routine basis with sufficient 
vehicles and facilities for emergency rescue operations. 

o Only a limited number of Apollo command modules will be available 
for refurbishment. Service modules, S-IB's and possible Titans 
will be even more limited in availability, aL.d will not be 
replaceable if used. These propulsion vehicles will only be 
available in the early phases of the Shuttle program because 
of potential aging problems. 


The logic used for determining the integrated approach Is shown in 
Figure 6-4. Different options are available, and different approaches 
recommended, according to the answers to the two key questions (shown in the 
diamonds in the figure): 

o Is Shuttle rescue available? 

o If so, is it quick enough to reach the distressed spacecraft 
on time? 

As pointed out earlier, these questions cannot be answered in this study, 
and will remain as program decisions to be made at a later date. The conclusions 
are therefore presented as depending on the answers to these questions. 

A. Shuttle rescue is available and is quick enough to reach distressed vehicle 
in time 

Shuttle rescue is recommended as the primary vehicle for deal with 
emergencies of all manned vehicles in earth orbit because of the cost effective- 
ness of the Shuttle as a rescue vehicle (if rescue is not needed, costs are 
practically zero) . 

B . Shuttle rescue is available but may not be quick enough to reach distressed 
vehicle in time . 

The specific concepts recommended for orbiter, sortie and space station 
vary, as follows: 


o Orbiter . Use the Escape CM as an escape vehicle; or the Surviv- 
ability CM or a specifically designed new MSV as a survivability 
module . 

o Sortie . Use the Escape CM as an escape vehicle; or incorporate 
survivability requirements in the sortie module. 

0 Spa c e Station . Use two Escape CM's as escape vehicles (for a 6-man 
station); or incorporate survivability in two space station modules, 
iv. . ■ v-i.‘ J.es are needed for a station, because the station is 
e.tpeettJ have two independent volumes, and a need for 
u’lai^onme^i" ’ indicate that at least one volume has become 
d <i - c' vTwIse unavailable. 
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C. Shuttle rescue is not available* 

The Escape CM is recommt ided for the orbiter on sortie and other 
missions. Since the Escape CM can hold 6 men at a maximum, this means 
that flights under such conditions should be limited to a maximum of 
6 men. 

Since it has been assumed that the Space Station will only operate 
when the Shuttle is fully operational and available for rescue, the 
question of escape is not applicable. 


v 
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ADAPTER 



Figure 6-5. Escape Apollo Command Module in Orbiter Cargo Bay 
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6.5 INTEGRATION OF ESCAPE COMMAND MODULE IN ORBITER AND SPACE STATION 

Typical integration of the Apollo command module as an escape concept 
in an orbiter with anr without a sortie payload is shown in Figure 6-5. 

For shuttle sortie missions with a crew and passenger complement of up to 
6 personnel, and with a sortie module or pallet payload, a single modified 
Apollo Escape CM can be used. 

Figure 6-5 illustrated how 6 men can be accommodated in an Escape CM. 
Because water landing can be ensured, only very little seat stroking is 
required. 

A typical example of two 6-man Escape CM's, one attached to each 
volume of a 2 volume NR station, is depicted in Figure 6-7, For the 12- 
iran station, the alternative exists for two 6-man devices for each 
station volume. 




Figure 6- 
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. Apollo Escape CM* 8 on 6-Man Space Station 
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6.6 MODULAR SURVIVABILITY VEHICLE (MSV) CONCEPT 

During the course of this task, it became apparent that the major 
emphasis of previous escape, rescue, and survivability studies was placed 
on the definition of escape vehicles. Only minor effort was directed toward 
defining a minimum capability, operationally flexible, and cost effective 
survivability vehicle which was free of the penalties associated with escape 
vehicles such as provisions for de-orbit, earth entry, landing, and recovery. 

The 2-man modular survivability vehicle conceived in this study (Fig. 
6-8) is cylindrical in shape and consists of three major sections: a 

forward section in which a docking and viewing port is fitted and in which 
crew supplies are stored; a center section which provides volu for 
shirtsleeve crew habitability; and an aft section in which subsystems 
equipment is mounted. A unique characteristic of this concept is that 
additional center sections, which are cylindrical shells, can be stacked to 
accommodate larger crew sizes (Fig. 6-9). 

Dimensional analysis showed that a minimum vehicle diameter of 2.3 m 
(90 in.) is required to facilitate 2 shirtsleeve crewmen in a standing, 
side-by-side position. 

An alternative to the two man across concept is the "four man across" 
concept, as shown in Fig. 6-3. A minimum vehicle diameter of 2.8 m (110 in.) 
not only accommodates four shirtsleeve men and is compatible with both the 
N" and MDAC docking concepts, but also results in smaller vehicle length 
f r crew sizes greater than two. Because of the fewer sectional elements 
required to accommodate larger crew sizes, the shorter length within the 
shuttle cargo bay (Fig. 6-10) and compatibility with both the NR and MDAC 
docking systems, the four man across concept is preferred. 

Subsystems and equipment required for a survivability module are shown 
in Table 6-2. 

A weight summary of the 4-man-ac''oss MSV is shown in Table 6-3, for 
a 12-man, 2-day capability. The structure consists of a skin stringer 
frame with a skin thickness of 0.5 mm (0.020 in), resulting in a vehicle 
primary structural weight of 214 kg (475 lb). Systems weights were obtained 
from the Aerospace Corporation report (Ref. 21). The total MSV weight, 
excluding crew, is 1310 kg (2908 lb). 

An alternative version would use a simpler monocoque structure with 
a skin thickness of 2 mm (0.080 in), which results in an additional weight 
of 80 kg (175 lb) for the MSV. 
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Figure 6-8 • 2-Man Modular Survivability Vehicle (MSV) 
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Table 6-2, Ciaw and Module Operational and Support Subsystems for 
4-Man-Across Survivability Vehicle 


Function 

Method 

ECS /LIFE SUPPORT 


Thermal control 

Sublimator (^0) 

Atmos . purification 

LiOH v particulate filter 

Humidity control 

Condensing heat exchanger 

Atmosphere 

14 . 7 psi 02 + N 2 

Atmosphere supply 

High pressure storage vessel 

Atmos . distribution 

Ducting 4- fans 

Potable water 

Storage tank with bacteria control equip. 

Food 

Dried - minimal quantity 

WASTE MANAGEMENT 


Urine 

Collection tube to receiver tank and 
odor control 

Fecal 

Bags + storage compartments + odor control 

ELECTRICAL POWER SYSTEM 


28 vdc 

Silver-zinc battf ries (A and B) 

Distribution 

Wiring/circuit protection devices - 
general + local 

Lighting (internal) 

General + local 

Lighting (external) 

Rendezvous, docking 

COMMUNICATION/ISS 


Up /down lines 

Voice 

Other 

Cont ro 1 /display /tracking 

Antennas 

Rendezvous /do eking aid 

ATTITUDE CONTROL 


Cold gas system 

O 2 TN 2 from cabin atmosphere supply tank 
supply 

Control mode 

+ pitch, + yaw, + roll, no translation, 
dampen module oscillations, orient 
module for orbiter approach and docking 

DOCKING 


Alignment of mating faces and 

Automatic upon module to orbiter contact 

sealing and latching 

Orbiter and module remotely separable 
after crew transfer to orbiter 

CREW SUPPLIES 


Sleep 

Sleep restraints 

Awake 

Modified sleep restraints 

Other 

Minimum hygiene medical supplies, local 
lighting/adjoining storage compartments 

MAIN CONTROL /DISPLAY PANEL 


Viewports (docking) 

Monitor, control, command status of: 
module subsystem, docking, crew sub- 
system, etc. 

MISCELLANEOUS 


Reading material 

Varied 
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Table 6-J. Weight Estimates - Four Man Across Survivability Vehicle 
12 Man - 2 Day 



-.-Kg 

lb 


Structure 

(390) 

(368) 


Primary 

214 

475 

* 

Hatch 

81 

180 

> 

Secondary Structure (15% System) 

96 

213 


Systems 

(535) 

(1418) 


S&C, ACS 

67 

150 


EPS 

45 

100 


Communications 

18 

40 


Atmosphere Supply & Control 

340 

756 


Waste Management 

27 

60 


Thermal Control 

122 

270 

* 

Miscellaneous 

30 

67 

5 

Total 

1030 

2286 

\ 

20% Growth 

206 

457 


Total Dry Weight 

1240 

2743 


Food, Water 

74 

165 


Total Weight 

1310 

290b 

% 

\ 

4 

i 

Delta to Monocoque Structure 

+80 

+175 

T 


1390 

3083 

5 


4 

.1 


I 


I 

I 
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6.7 RENOVATION/MODIFICATION OF APOLLO COMMAND MODULE FOR USE AS AN ESCAPE 

OR SURVIVABILITY VEHICLE 

The potential impact of renovating an Apollo Command Module to funccion 
as escape or survivability vehicle, assuming maximum use of evisting subsys- 
tems is shown in Table 6-4 . 

Although a new retro-system is shown for escape vehicle applications, it 
may be possible to achieve the required delta-velocity of approximately 
150 m/s (500 f/s) by providing additional RCS propellant tanks within the 
command module. Present Command Module capability is approximately 27 m/s 
(90 f/s) and requires approximately 0.24 Kg propellant per m/s (1.78 lb per 
f/s). This option, could result in considerably iower cost in achieving 
retro capability. 
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Table 6-4 . 

Renovate/New/Modified Items for Refurbished Apollo CM for Use as 
Escape or Survivability Vehicle 


ITEM 


1. Renovate or replace heat shield 

2. Modify CM to 6-man entry capacity (if mission requires) 

3. Replace Earth Recovery System (chutes, mortars, fittings) 

4. Add new Retro-system 

5. Renovate or replace ROS engines 

6. Replace Earth Landing System Crushable ribs (if req'd.) 

7. Renovate or replace Electrical Power System (EPS) 
batteries 



Applicability 


x 

X 


8. Replace Docking System (CM probe and adapter ring left 
attached to Lunar Module) 

9. Replace Uprighting System if required (15$ probability 
that it will not be used on landing) 

10. Replace G&N exterior mirror lens and prism elements 


x 


X 


X 


X 


X 


11. Renovate or replace G&N optics heat shield 


x 


12 . 


Modify Environmental Control and Life Support System 
(ECLSS) to survivability requirements 


x 


A 

) 

A 

4 

i 

1 

,1 

i 

i 
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